1 /* 2 * DPP functionality shared between hostapd and wpa_supplicant 3 * Copyright (c) 2017, Qualcomm Atheros, Inc. 4 * Copyright (c) 2018-2019, The Linux Foundation 5 * 6 * This software may be distributed under the terms of the BSD license. 7 * See README for more details. 8 */ 9 10 #include "utils/includes.h" 11 #include <openssl/opensslv.h> 12 #include <openssl/err.h> 13 #include <openssl/asn1.h> 14 #include <openssl/asn1t.h> 15 16 #include "utils/common.h" 17 #include "utils/base64.h" 18 #include "utils/json.h" 19 #include "common/ieee802_11_common.h" 20 #include "common/ieee802_11_defs.h" 21 #include "common/wpa_ctrl.h" 22 #include "common/gas.h" 23 #include "crypto/crypto.h" 24 #include "crypto/random.h" 25 #include "crypto/aes.h" 26 #include "crypto/aes_siv.h" 27 #include "crypto/sha384.h" 28 #include "crypto/sha512.h" 29 #include "drivers/driver.h" 30 #include "dpp.h" 31 32 33 #ifdef CONFIG_TESTING_OPTIONS 34 enum dpp_test_behavior dpp_test = DPP_TEST_DISABLED; 35 u8 dpp_pkex_own_mac_override[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 }; 36 u8 dpp_pkex_peer_mac_override[ETH_ALEN] = { 0, 0, 0, 0, 0, 0 }; 37 u8 dpp_pkex_ephemeral_key_override[600]; 38 size_t dpp_pkex_ephemeral_key_override_len = 0; 39 u8 dpp_protocol_key_override[600]; 40 size_t dpp_protocol_key_override_len = 0; 41 u8 dpp_nonce_override[DPP_MAX_NONCE_LEN]; 42 size_t dpp_nonce_override_len = 0; 43 44 static int dpp_test_gen_invalid_key(struct wpabuf *msg, 45 const struct dpp_curve_params *curve); 46 #endif /* CONFIG_TESTING_OPTIONS */ 47 48 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 49 (defined(LIBRESSL_VERSION_NUMBER) && \ 50 LIBRESSL_VERSION_NUMBER < 0x20700000L) 51 /* Compatibility wrappers for older versions. */ 52 53 static int ECDSA_SIG_set0(ECDSA_SIG *sig, BIGNUM *r, BIGNUM *s) 54 { 55 sig->r = r; 56 sig->s = s; 57 return 1; 58 } 59 60 61 static void ECDSA_SIG_get0(const ECDSA_SIG *sig, const BIGNUM **pr, 62 const BIGNUM **ps) 63 { 64 if (pr) 65 *pr = sig->r; 66 if (ps) 67 *ps = sig->s; 68 } 69 70 #endif 71 72 73 struct dpp_global { 74 struct dl_list bootstrap; /* struct dpp_bootstrap_info */ 75 struct dl_list configurator; /* struct dpp_configurator */ 76 }; 77 78 static const struct dpp_curve_params dpp_curves[] = { 79 /* The mandatory to support and the default NIST P-256 curve needs to 80 * be the first entry on this list. */ 81 { "prime256v1", 32, 32, 16, 32, "P-256", 19, "ES256" }, 82 { "secp384r1", 48, 48, 24, 48, "P-384", 20, "ES384" }, 83 { "secp521r1", 64, 64, 32, 66, "P-521", 21, "ES512" }, 84 { "brainpoolP256r1", 32, 32, 16, 32, "BP-256", 28, "BS256" }, 85 { "brainpoolP384r1", 48, 48, 24, 48, "BP-384", 29, "BS384" }, 86 { "brainpoolP512r1", 64, 64, 32, 64, "BP-512", 30, "BS512" }, 87 { NULL, 0, 0, 0, 0, NULL, 0, NULL } 88 }; 89 90 91 /* Role-specific elements for PKEX */ 92 93 /* NIST P-256 */ 94 static const u8 pkex_init_x_p256[32] = { 95 0x56, 0x26, 0x12, 0xcf, 0x36, 0x48, 0xfe, 0x0b, 96 0x07, 0x04, 0xbb, 0x12, 0x22, 0x50, 0xb2, 0x54, 97 0xb1, 0x94, 0x64, 0x7e, 0x54, 0xce, 0x08, 0x07, 98 0x2e, 0xec, 0xca, 0x74, 0x5b, 0x61, 0x2d, 0x25 99 }; 100 static const u8 pkex_init_y_p256[32] = { 101 0x3e, 0x44, 0xc7, 0xc9, 0x8c, 0x1c, 0xa1, 0x0b, 102 0x20, 0x09, 0x93, 0xb2, 0xfd, 0xe5, 0x69, 0xdc, 103 0x75, 0xbc, 0xad, 0x33, 0xc1, 0xe7, 0xc6, 0x45, 104 0x4d, 0x10, 0x1e, 0x6a, 0x3d, 0x84, 0x3c, 0xa4 105 }; 106 static const u8 pkex_resp_x_p256[32] = { 107 0x1e, 0xa4, 0x8a, 0xb1, 0xa4, 0xe8, 0x42, 0x39, 108 0xad, 0x73, 0x07, 0xf2, 0x34, 0xdf, 0x57, 0x4f, 109 0xc0, 0x9d, 0x54, 0xbe, 0x36, 0x1b, 0x31, 0x0f, 110 0x59, 0x91, 0x52, 0x33, 0xac, 0x19, 0x9d, 0x76 111 }; 112 static const u8 pkex_resp_y_p256[32] = { 113 0xd9, 0xfb, 0xf6, 0xb9, 0xf5, 0xfa, 0xdf, 0x19, 114 0x58, 0xd8, 0x3e, 0xc9, 0x89, 0x7a, 0x35, 0xc1, 115 0xbd, 0xe9, 0x0b, 0x77, 0x7a, 0xcb, 0x91, 0x2a, 116 0xe8, 0x21, 0x3f, 0x47, 0x52, 0x02, 0x4d, 0x67 117 }; 118 119 /* NIST P-384 */ 120 static const u8 pkex_init_x_p384[48] = { 121 0x95, 0x3f, 0x42, 0x9e, 0x50, 0x7f, 0xf9, 0xaa, 122 0xac, 0x1a, 0xf2, 0x85, 0x2e, 0x64, 0x91, 0x68, 123 0x64, 0xc4, 0x3c, 0xb7, 0x5c, 0xf8, 0xc9, 0x53, 124 0x6e, 0x58, 0x4c, 0x7f, 0xc4, 0x64, 0x61, 0xac, 125 0x51, 0x8a, 0x6f, 0xfe, 0xab, 0x74, 0xe6, 0x12, 126 0x81, 0xac, 0x38, 0x5d, 0x41, 0xe6, 0xb9, 0xa3 127 }; 128 static const u8 pkex_init_y_p384[48] = { 129 0x76, 0x2f, 0x68, 0x84, 0xa6, 0xb0, 0x59, 0x29, 130 0x83, 0xa2, 0x6c, 0xa4, 0x6c, 0x3b, 0xf8, 0x56, 131 0x76, 0x11, 0x2a, 0x32, 0x90, 0xbd, 0x07, 0xc7, 132 0x37, 0x39, 0x9d, 0xdb, 0x96, 0xf3, 0x2b, 0xb6, 133 0x27, 0xbb, 0x29, 0x3c, 0x17, 0x33, 0x9d, 0x94, 134 0xc3, 0xda, 0xac, 0x46, 0xb0, 0x8e, 0x07, 0x18 135 }; 136 static const u8 pkex_resp_x_p384[48] = { 137 0xad, 0xbe, 0xd7, 0x1d, 0x3a, 0x71, 0x64, 0x98, 138 0x5f, 0xb4, 0xd6, 0x4b, 0x50, 0xd0, 0x84, 0x97, 139 0x4b, 0x7e, 0x57, 0x70, 0xd2, 0xd9, 0xf4, 0x92, 140 0x2a, 0x3f, 0xce, 0x99, 0xc5, 0x77, 0x33, 0x44, 141 0x14, 0x56, 0x92, 0xcb, 0xae, 0x46, 0x64, 0xdf, 142 0xe0, 0xbb, 0xd7, 0xb1, 0x29, 0x20, 0x72, 0xdf 143 }; 144 static const u8 pkex_resp_y_p384[48] = { 145 0xab, 0xa7, 0xdf, 0x52, 0xaa, 0xe2, 0x35, 0x0c, 146 0xe3, 0x75, 0x32, 0xe6, 0xbf, 0x06, 0xc8, 0x7c, 147 0x38, 0x29, 0x4c, 0xec, 0x82, 0xac, 0xd7, 0xa3, 148 0x09, 0xd2, 0x0e, 0x22, 0x5a, 0x74, 0x52, 0xa1, 149 0x7e, 0x54, 0x4e, 0xfe, 0xc6, 0x29, 0x33, 0x63, 150 0x15, 0xe1, 0x7b, 0xe3, 0x40, 0x1c, 0xca, 0x06 151 }; 152 153 /* NIST P-521 */ 154 static const u8 pkex_init_x_p521[66] = { 155 0x00, 0x16, 0x20, 0x45, 0x19, 0x50, 0x95, 0x23, 156 0x0d, 0x24, 0xbe, 0x00, 0x87, 0xdc, 0xfa, 0xf0, 157 0x58, 0x9a, 0x01, 0x60, 0x07, 0x7a, 0xca, 0x76, 158 0x01, 0xab, 0x2d, 0x5a, 0x46, 0xcd, 0x2c, 0xb5, 159 0x11, 0x9a, 0xff, 0xaa, 0x48, 0x04, 0x91, 0x38, 160 0xcf, 0x86, 0xfc, 0xa4, 0xa5, 0x0f, 0x47, 0x01, 161 0x80, 0x1b, 0x30, 0xa3, 0xae, 0xe8, 0x1c, 0x2e, 162 0xea, 0xcc, 0xf0, 0x03, 0x9f, 0x77, 0x4c, 0x8d, 163 0x97, 0x76 164 }; 165 static const u8 pkex_init_y_p521[66] = { 166 0x00, 0xb3, 0x8e, 0x02, 0xe4, 0x2a, 0x63, 0x59, 167 0x12, 0xc6, 0x10, 0xba, 0x3a, 0xf9, 0x02, 0x99, 168 0x3f, 0x14, 0xf0, 0x40, 0xde, 0x5c, 0xc9, 0x8b, 169 0x02, 0x55, 0xfa, 0x91, 0xb1, 0xcc, 0x6a, 0xbd, 170 0xe5, 0x62, 0xc0, 0xc5, 0xe3, 0xa1, 0x57, 0x9f, 171 0x08, 0x1a, 0xa6, 0xe2, 0xf8, 0x55, 0x90, 0xbf, 172 0xf5, 0xa6, 0xc3, 0xd8, 0x52, 0x1f, 0xb7, 0x02, 173 0x2e, 0x7c, 0xc8, 0xb3, 0x20, 0x1e, 0x79, 0x8d, 174 0x03, 0xa8 175 }; 176 static const u8 pkex_resp_x_p521[66] = { 177 0x00, 0x79, 0xe4, 0x4d, 0x6b, 0x5e, 0x12, 0x0a, 178 0x18, 0x2c, 0xb3, 0x05, 0x77, 0x0f, 0xc3, 0x44, 179 0x1a, 0xcd, 0x78, 0x46, 0x14, 0xee, 0x46, 0x3f, 180 0xab, 0xc9, 0x59, 0x7c, 0x85, 0xa0, 0xc2, 0xfb, 181 0x02, 0x32, 0x99, 0xde, 0x5d, 0xe1, 0x0d, 0x48, 182 0x2d, 0x71, 0x7d, 0x8d, 0x3f, 0x61, 0x67, 0x9e, 183 0x2b, 0x8b, 0x12, 0xde, 0x10, 0x21, 0x55, 0x0a, 184 0x5b, 0x2d, 0xe8, 0x05, 0x09, 0xf6, 0x20, 0x97, 185 0x84, 0xb4 186 }; 187 static const u8 pkex_resp_y_p521[66] = { 188 0x00, 0x46, 0x63, 0x39, 0xbe, 0xcd, 0xa4, 0x2d, 189 0xca, 0x27, 0x74, 0xd4, 0x1b, 0x91, 0x33, 0x20, 190 0x83, 0xc7, 0x3b, 0xa4, 0x09, 0x8b, 0x8e, 0xa3, 191 0x88, 0xe9, 0x75, 0x7f, 0x56, 0x7b, 0x38, 0x84, 192 0x62, 0x02, 0x7c, 0x90, 0x51, 0x07, 0xdb, 0xe9, 193 0xd0, 0xde, 0xda, 0x9a, 0x5d, 0xe5, 0x94, 0xd2, 194 0xcf, 0x9d, 0x4c, 0x33, 0x91, 0xa6, 0xc3, 0x80, 195 0xa7, 0x6e, 0x7e, 0x8d, 0xf8, 0x73, 0x6e, 0x53, 196 0xce, 0xe1 197 }; 198 199 /* Brainpool P-256r1 */ 200 static const u8 pkex_init_x_bp_p256r1[32] = { 201 0x46, 0x98, 0x18, 0x6c, 0x27, 0xcd, 0x4b, 0x10, 202 0x7d, 0x55, 0xa3, 0xdd, 0x89, 0x1f, 0x9f, 0xca, 203 0xc7, 0x42, 0x5b, 0x8a, 0x23, 0xed, 0xf8, 0x75, 204 0xac, 0xc7, 0xe9, 0x8d, 0xc2, 0x6f, 0xec, 0xd8 205 }; 206 static const u8 pkex_init_y_bp_p256r1[32] = { 207 0x93, 0xca, 0xef, 0xa9, 0x66, 0x3e, 0x87, 0xcd, 208 0x52, 0x6e, 0x54, 0x13, 0xef, 0x31, 0x67, 0x30, 209 0x15, 0x13, 0x9d, 0x6d, 0xc0, 0x95, 0x32, 0xbe, 210 0x4f, 0xab, 0x5d, 0xf7, 0xbf, 0x5e, 0xaa, 0x0b 211 }; 212 static const u8 pkex_resp_x_bp_p256r1[32] = { 213 0x90, 0x18, 0x84, 0xc9, 0xdc, 0xcc, 0xb5, 0x2f, 214 0x4a, 0x3f, 0x4f, 0x18, 0x0a, 0x22, 0x56, 0x6a, 215 0xa9, 0xef, 0xd4, 0xe6, 0xc3, 0x53, 0xc2, 0x1a, 216 0x23, 0x54, 0xdd, 0x08, 0x7e, 0x10, 0xd8, 0xe3 217 }; 218 static const u8 pkex_resp_y_bp_p256r1[32] = { 219 0x2a, 0xfa, 0x98, 0x9b, 0xe3, 0xda, 0x30, 0xfd, 220 0x32, 0x28, 0xcb, 0x66, 0xfb, 0x40, 0x7f, 0xf2, 221 0xb2, 0x25, 0x80, 0x82, 0x44, 0x85, 0x13, 0x7e, 222 0x4b, 0xb5, 0x06, 0xc0, 0x03, 0x69, 0x23, 0x64 223 }; 224 225 /* Brainpool P-384r1 */ 226 static const u8 pkex_init_x_bp_p384r1[48] = { 227 0x0a, 0x2c, 0xeb, 0x49, 0x5e, 0xb7, 0x23, 0xbd, 228 0x20, 0x5b, 0xe0, 0x49, 0xdf, 0xcf, 0xcf, 0x19, 229 0x37, 0x36, 0xe1, 0x2f, 0x59, 0xdb, 0x07, 0x06, 230 0xb5, 0xeb, 0x2d, 0xae, 0xc2, 0xb2, 0x38, 0x62, 231 0xa6, 0x73, 0x09, 0xa0, 0x6c, 0x0a, 0xa2, 0x30, 232 0x99, 0xeb, 0xf7, 0x1e, 0x47, 0xb9, 0x5e, 0xbe 233 }; 234 static const u8 pkex_init_y_bp_p384r1[48] = { 235 0x54, 0x76, 0x61, 0x65, 0x75, 0x5a, 0x2f, 0x99, 236 0x39, 0x73, 0xca, 0x6c, 0xf9, 0xf7, 0x12, 0x86, 237 0x54, 0xd5, 0xd4, 0xad, 0x45, 0x7b, 0xbf, 0x32, 238 0xee, 0x62, 0x8b, 0x9f, 0x52, 0xe8, 0xa0, 0xc9, 239 0xb7, 0x9d, 0xd1, 0x09, 0xb4, 0x79, 0x1c, 0x3e, 240 0x1a, 0xbf, 0x21, 0x45, 0x66, 0x6b, 0x02, 0x52 241 }; 242 static const u8 pkex_resp_x_bp_p384r1[48] = { 243 0x03, 0xa2, 0x57, 0xef, 0xe8, 0x51, 0x21, 0xa0, 244 0xc8, 0x9e, 0x21, 0x02, 0xb5, 0x9a, 0x36, 0x25, 245 0x74, 0x22, 0xd1, 0xf2, 0x1b, 0xa8, 0x9a, 0x9b, 246 0x97, 0xbc, 0x5a, 0xeb, 0x26, 0x15, 0x09, 0x71, 247 0x77, 0x59, 0xec, 0x8b, 0xb7, 0xe1, 0xe8, 0xce, 248 0x65, 0xb8, 0xaf, 0xf8, 0x80, 0xae, 0x74, 0x6c 249 }; 250 static const u8 pkex_resp_y_bp_p384r1[48] = { 251 0x2f, 0xd9, 0x6a, 0xc7, 0x3e, 0xec, 0x76, 0x65, 252 0x2d, 0x38, 0x7f, 0xec, 0x63, 0x26, 0x3f, 0x04, 253 0xd8, 0x4e, 0xff, 0xe1, 0x0a, 0x51, 0x74, 0x70, 254 0xe5, 0x46, 0x63, 0x7f, 0x5c, 0xc0, 0xd1, 0x7c, 255 0xfb, 0x2f, 0xea, 0xe2, 0xd8, 0x0f, 0x84, 0xcb, 256 0xe9, 0x39, 0x5c, 0x64, 0xfe, 0xcb, 0x2f, 0xf1 257 }; 258 259 /* Brainpool P-512r1 */ 260 static const u8 pkex_init_x_bp_p512r1[64] = { 261 0x4c, 0xe9, 0xb6, 0x1c, 0xe2, 0x00, 0x3c, 0x9c, 262 0xa9, 0xc8, 0x56, 0x52, 0xaf, 0x87, 0x3e, 0x51, 263 0x9c, 0xbb, 0x15, 0x31, 0x1e, 0xc1, 0x05, 0xfc, 264 0x7c, 0x77, 0xd7, 0x37, 0x61, 0x27, 0xd0, 0x95, 265 0x98, 0xee, 0x5d, 0xa4, 0x3d, 0x09, 0xdb, 0x3d, 266 0xfa, 0x89, 0x9e, 0x7f, 0xa6, 0xa6, 0x9c, 0xff, 267 0x83, 0x5c, 0x21, 0x6c, 0x3e, 0xf2, 0xfe, 0xdc, 268 0x63, 0xe4, 0xd1, 0x0e, 0x75, 0x45, 0x69, 0x0f 269 }; 270 static const u8 pkex_init_y_bp_p512r1[64] = { 271 0x50, 0xb5, 0x9b, 0xfa, 0x45, 0x67, 0x75, 0x94, 272 0x44, 0xe7, 0x68, 0xb0, 0xeb, 0x3e, 0xb3, 0xb8, 273 0xf9, 0x99, 0x05, 0xef, 0xae, 0x6c, 0xbc, 0xe3, 274 0xe1, 0xd2, 0x51, 0x54, 0xdf, 0x59, 0xd4, 0x45, 275 0x41, 0x3a, 0xa8, 0x0b, 0x76, 0x32, 0x44, 0x0e, 276 0x07, 0x60, 0x3a, 0x6e, 0xbe, 0xfe, 0xe0, 0x58, 277 0x52, 0xa0, 0xaa, 0x8b, 0xd8, 0x5b, 0xf2, 0x71, 278 0x11, 0x9a, 0x9e, 0x8f, 0x1a, 0xd1, 0xc9, 0x99 279 }; 280 static const u8 pkex_resp_x_bp_p512r1[64] = { 281 0x2a, 0x60, 0x32, 0x27, 0xa1, 0xe6, 0x94, 0x72, 282 0x1c, 0x48, 0xbe, 0xc5, 0x77, 0x14, 0x30, 0x76, 283 0xe4, 0xbf, 0xf7, 0x7b, 0xc5, 0xfd, 0xdf, 0x19, 284 0x1e, 0x0f, 0xdf, 0x1c, 0x40, 0xfa, 0x34, 0x9e, 285 0x1f, 0x42, 0x24, 0xa3, 0x2c, 0xd5, 0xc7, 0xc9, 286 0x7b, 0x47, 0x78, 0x96, 0xf1, 0x37, 0x0e, 0x88, 287 0xcb, 0xa6, 0x52, 0x29, 0xd7, 0xa8, 0x38, 0x29, 288 0x8e, 0x6e, 0x23, 0x47, 0xd4, 0x4b, 0x70, 0x3e 289 }; 290 static const u8 pkex_resp_y_bp_p512r1[64] = { 291 0x80, 0x1f, 0x43, 0xd2, 0x17, 0x35, 0xec, 0x81, 292 0xd9, 0x4b, 0xdc, 0x81, 0x19, 0xd9, 0x5f, 0x68, 293 0x16, 0x84, 0xfe, 0x63, 0x4b, 0x8d, 0x5d, 0xaa, 294 0x88, 0x4a, 0x47, 0x48, 0xd4, 0xea, 0xab, 0x7d, 295 0x6a, 0xbf, 0xe1, 0x28, 0x99, 0x6a, 0x87, 0x1c, 296 0x30, 0xb4, 0x44, 0x2d, 0x75, 0xac, 0x35, 0x09, 297 0x73, 0x24, 0x3d, 0xb4, 0x43, 0xb1, 0xc1, 0x56, 298 0x56, 0xad, 0x30, 0x87, 0xf4, 0xc3, 0x00, 0xc7 299 }; 300 301 302 static void dpp_debug_print_point(const char *title, const EC_GROUP *group, 303 const EC_POINT *point) 304 { 305 BIGNUM *x, *y; 306 BN_CTX *ctx; 307 char *x_str = NULL, *y_str = NULL; 308 309 if (!wpa_debug_show_keys) 310 return; 311 312 ctx = BN_CTX_new(); 313 x = BN_new(); 314 y = BN_new(); 315 if (!ctx || !x || !y || 316 EC_POINT_get_affine_coordinates_GFp(group, point, x, y, ctx) != 1) 317 goto fail; 318 319 x_str = BN_bn2hex(x); 320 y_str = BN_bn2hex(y); 321 if (!x_str || !y_str) 322 goto fail; 323 324 wpa_printf(MSG_DEBUG, "%s (%s,%s)", title, x_str, y_str); 325 326 fail: 327 OPENSSL_free(x_str); 328 OPENSSL_free(y_str); 329 BN_free(x); 330 BN_free(y); 331 BN_CTX_free(ctx); 332 } 333 334 335 static int dpp_hash_vector(const struct dpp_curve_params *curve, 336 size_t num_elem, const u8 *addr[], const size_t *len, 337 u8 *mac) 338 { 339 if (curve->hash_len == 32) 340 return sha256_vector(num_elem, addr, len, mac); 341 if (curve->hash_len == 48) 342 return sha384_vector(num_elem, addr, len, mac); 343 if (curve->hash_len == 64) 344 return sha512_vector(num_elem, addr, len, mac); 345 return -1; 346 } 347 348 349 static int dpp_hkdf_expand(size_t hash_len, const u8 *secret, size_t secret_len, 350 const char *label, u8 *out, size_t outlen) 351 { 352 if (hash_len == 32) 353 return hmac_sha256_kdf(secret, secret_len, NULL, 354 (const u8 *) label, os_strlen(label), 355 out, outlen); 356 if (hash_len == 48) 357 return hmac_sha384_kdf(secret, secret_len, NULL, 358 (const u8 *) label, os_strlen(label), 359 out, outlen); 360 if (hash_len == 64) 361 return hmac_sha512_kdf(secret, secret_len, NULL, 362 (const u8 *) label, os_strlen(label), 363 out, outlen); 364 return -1; 365 } 366 367 368 static int dpp_hmac_vector(size_t hash_len, const u8 *key, size_t key_len, 369 size_t num_elem, const u8 *addr[], 370 const size_t *len, u8 *mac) 371 { 372 if (hash_len == 32) 373 return hmac_sha256_vector(key, key_len, num_elem, addr, len, 374 mac); 375 if (hash_len == 48) 376 return hmac_sha384_vector(key, key_len, num_elem, addr, len, 377 mac); 378 if (hash_len == 64) 379 return hmac_sha512_vector(key, key_len, num_elem, addr, len, 380 mac); 381 return -1; 382 } 383 384 385 static int dpp_hmac(size_t hash_len, const u8 *key, size_t key_len, 386 const u8 *data, size_t data_len, u8 *mac) 387 { 388 if (hash_len == 32) 389 return hmac_sha256(key, key_len, data, data_len, mac); 390 if (hash_len == 48) 391 return hmac_sha384(key, key_len, data, data_len, mac); 392 if (hash_len == 64) 393 return hmac_sha512(key, key_len, data, data_len, mac); 394 return -1; 395 } 396 397 398 static int dpp_bn2bin_pad(const BIGNUM *bn, u8 *pos, size_t len) 399 { 400 int num_bytes, offset; 401 402 num_bytes = BN_num_bytes(bn); 403 if ((size_t) num_bytes > len) 404 return -1; 405 offset = len - num_bytes; 406 os_memset(pos, 0, offset); 407 BN_bn2bin(bn, pos + offset); 408 return 0; 409 } 410 411 412 static struct wpabuf * dpp_get_pubkey_point(EVP_PKEY *pkey, int prefix) 413 { 414 int len, res; 415 EC_KEY *eckey; 416 struct wpabuf *buf; 417 unsigned char *pos; 418 419 eckey = EVP_PKEY_get1_EC_KEY(pkey); 420 if (!eckey) 421 return NULL; 422 EC_KEY_set_conv_form(eckey, POINT_CONVERSION_UNCOMPRESSED); 423 len = i2o_ECPublicKey(eckey, NULL); 424 if (len <= 0) { 425 wpa_printf(MSG_ERROR, 426 "DDP: Failed to determine public key encoding length"); 427 EC_KEY_free(eckey); 428 return NULL; 429 } 430 431 buf = wpabuf_alloc(len); 432 if (!buf) { 433 EC_KEY_free(eckey); 434 return NULL; 435 } 436 437 pos = wpabuf_put(buf, len); 438 res = i2o_ECPublicKey(eckey, &pos); 439 EC_KEY_free(eckey); 440 if (res != len) { 441 wpa_printf(MSG_ERROR, 442 "DDP: Failed to encode public key (res=%d/%d)", 443 res, len); 444 wpabuf_free(buf); 445 return NULL; 446 } 447 448 if (!prefix) { 449 /* Remove 0x04 prefix to match DPP definition */ 450 pos = wpabuf_mhead(buf); 451 os_memmove(pos, pos + 1, len - 1); 452 buf->used--; 453 } 454 455 return buf; 456 } 457 458 459 static EVP_PKEY * dpp_set_pubkey_point_group(const EC_GROUP *group, 460 const u8 *buf_x, const u8 *buf_y, 461 size_t len) 462 { 463 EC_KEY *eckey = NULL; 464 BN_CTX *ctx; 465 EC_POINT *point = NULL; 466 BIGNUM *x = NULL, *y = NULL; 467 EVP_PKEY *pkey = NULL; 468 469 ctx = BN_CTX_new(); 470 if (!ctx) { 471 wpa_printf(MSG_ERROR, "DPP: Out of memory"); 472 return NULL; 473 } 474 475 point = EC_POINT_new(group); 476 x = BN_bin2bn(buf_x, len, NULL); 477 y = BN_bin2bn(buf_y, len, NULL); 478 if (!point || !x || !y) { 479 wpa_printf(MSG_ERROR, "DPP: Out of memory"); 480 goto fail; 481 } 482 483 if (!EC_POINT_set_affine_coordinates_GFp(group, point, x, y, ctx)) { 484 wpa_printf(MSG_ERROR, 485 "DPP: OpenSSL: EC_POINT_set_affine_coordinates_GFp failed: %s", 486 ERR_error_string(ERR_get_error(), NULL)); 487 goto fail; 488 } 489 490 if (!EC_POINT_is_on_curve(group, point, ctx) || 491 EC_POINT_is_at_infinity(group, point)) { 492 wpa_printf(MSG_ERROR, "DPP: Invalid point"); 493 goto fail; 494 } 495 dpp_debug_print_point("DPP: dpp_set_pubkey_point_group", group, point); 496 497 eckey = EC_KEY_new(); 498 if (!eckey || 499 EC_KEY_set_group(eckey, group) != 1 || 500 EC_KEY_set_public_key(eckey, point) != 1) { 501 wpa_printf(MSG_ERROR, 502 "DPP: Failed to set EC_KEY: %s", 503 ERR_error_string(ERR_get_error(), NULL)); 504 goto fail; 505 } 506 EC_KEY_set_asn1_flag(eckey, OPENSSL_EC_NAMED_CURVE); 507 508 pkey = EVP_PKEY_new(); 509 if (!pkey || EVP_PKEY_set1_EC_KEY(pkey, eckey) != 1) { 510 wpa_printf(MSG_ERROR, "DPP: Could not create EVP_PKEY"); 511 goto fail; 512 } 513 514 out: 515 BN_free(x); 516 BN_free(y); 517 EC_KEY_free(eckey); 518 EC_POINT_free(point); 519 BN_CTX_free(ctx); 520 return pkey; 521 fail: 522 EVP_PKEY_free(pkey); 523 pkey = NULL; 524 goto out; 525 } 526 527 528 static EVP_PKEY * dpp_set_pubkey_point(EVP_PKEY *group_key, 529 const u8 *buf, size_t len) 530 { 531 EC_KEY *eckey; 532 const EC_GROUP *group; 533 EVP_PKEY *pkey = NULL; 534 535 if (len & 1) 536 return NULL; 537 538 eckey = EVP_PKEY_get1_EC_KEY(group_key); 539 if (!eckey) { 540 wpa_printf(MSG_ERROR, 541 "DPP: Could not get EC_KEY from group_key"); 542 return NULL; 543 } 544 545 group = EC_KEY_get0_group(eckey); 546 if (group) 547 pkey = dpp_set_pubkey_point_group(group, buf, buf + len / 2, 548 len / 2); 549 else 550 wpa_printf(MSG_ERROR, "DPP: Could not get EC group"); 551 552 EC_KEY_free(eckey); 553 return pkey; 554 } 555 556 557 static void dpp_auth_fail(struct dpp_authentication *auth, const char *txt) 558 { 559 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "%s", txt); 560 } 561 562 563 struct wpabuf * dpp_alloc_msg(enum dpp_public_action_frame_type type, 564 size_t len) 565 { 566 struct wpabuf *msg; 567 568 msg = wpabuf_alloc(8 + len); 569 if (!msg) 570 return NULL; 571 wpabuf_put_u8(msg, WLAN_ACTION_PUBLIC); 572 wpabuf_put_u8(msg, WLAN_PA_VENDOR_SPECIFIC); 573 wpabuf_put_be24(msg, OUI_WFA); 574 wpabuf_put_u8(msg, DPP_OUI_TYPE); 575 wpabuf_put_u8(msg, 1); /* Crypto Suite */ 576 wpabuf_put_u8(msg, type); 577 return msg; 578 } 579 580 581 const u8 * dpp_get_attr(const u8 *buf, size_t len, u16 req_id, u16 *ret_len) 582 { 583 u16 id, alen; 584 const u8 *pos = buf, *end = buf + len; 585 586 while (end - pos >= 4) { 587 id = WPA_GET_LE16(pos); 588 pos += 2; 589 alen = WPA_GET_LE16(pos); 590 pos += 2; 591 if (alen > end - pos) 592 return NULL; 593 if (id == req_id) { 594 *ret_len = alen; 595 return pos; 596 } 597 pos += alen; 598 } 599 600 return NULL; 601 } 602 603 604 int dpp_check_attrs(const u8 *buf, size_t len) 605 { 606 const u8 *pos, *end; 607 int wrapped_data = 0; 608 609 pos = buf; 610 end = buf + len; 611 while (end - pos >= 4) { 612 u16 id, alen; 613 614 id = WPA_GET_LE16(pos); 615 pos += 2; 616 alen = WPA_GET_LE16(pos); 617 pos += 2; 618 wpa_printf(MSG_MSGDUMP, "DPP: Attribute ID %04x len %u", 619 id, alen); 620 if (alen > end - pos) { 621 wpa_printf(MSG_DEBUG, 622 "DPP: Truncated message - not enough room for the attribute - dropped"); 623 return -1; 624 } 625 if (wrapped_data) { 626 wpa_printf(MSG_DEBUG, 627 "DPP: An unexpected attribute included after the Wrapped Data attribute"); 628 return -1; 629 } 630 if (id == DPP_ATTR_WRAPPED_DATA) 631 wrapped_data = 1; 632 pos += alen; 633 } 634 635 if (end != pos) { 636 wpa_printf(MSG_DEBUG, 637 "DPP: Unexpected octets (%d) after the last attribute", 638 (int) (end - pos)); 639 return -1; 640 } 641 642 return 0; 643 } 644 645 646 void dpp_bootstrap_info_free(struct dpp_bootstrap_info *info) 647 { 648 if (!info) 649 return; 650 os_free(info->uri); 651 os_free(info->info); 652 EVP_PKEY_free(info->pubkey); 653 os_free(info); 654 } 655 656 657 const char * dpp_bootstrap_type_txt(enum dpp_bootstrap_type type) 658 { 659 switch (type) { 660 case DPP_BOOTSTRAP_QR_CODE: 661 return "QRCODE"; 662 case DPP_BOOTSTRAP_PKEX: 663 return "PKEX"; 664 } 665 return "??"; 666 } 667 668 669 static int dpp_uri_valid_info(const char *info) 670 { 671 while (*info) { 672 unsigned char val = *info++; 673 674 if (val < 0x20 || val > 0x7e || val == 0x3b) 675 return 0; 676 } 677 678 return 1; 679 } 680 681 682 static int dpp_clone_uri(struct dpp_bootstrap_info *bi, const char *uri) 683 { 684 bi->uri = os_strdup(uri); 685 return bi->uri ? 0 : -1; 686 } 687 688 689 int dpp_parse_uri_chan_list(struct dpp_bootstrap_info *bi, 690 const char *chan_list) 691 { 692 const char *pos = chan_list; 693 int opclass, channel, freq; 694 695 while (pos && *pos && *pos != ';') { 696 opclass = atoi(pos); 697 if (opclass <= 0) 698 goto fail; 699 pos = os_strchr(pos, '/'); 700 if (!pos) 701 goto fail; 702 pos++; 703 channel = atoi(pos); 704 if (channel <= 0) 705 goto fail; 706 while (*pos >= '0' && *pos <= '9') 707 pos++; 708 freq = ieee80211_chan_to_freq(NULL, opclass, channel); 709 wpa_printf(MSG_DEBUG, 710 "DPP: URI channel-list: opclass=%d channel=%d ==> freq=%d", 711 opclass, channel, freq); 712 if (freq < 0) { 713 wpa_printf(MSG_DEBUG, 714 "DPP: Ignore unknown URI channel-list channel (opclass=%d channel=%d)", 715 opclass, channel); 716 } else if (bi->num_freq == DPP_BOOTSTRAP_MAX_FREQ) { 717 wpa_printf(MSG_DEBUG, 718 "DPP: Too many channels in URI channel-list - ignore list"); 719 bi->num_freq = 0; 720 break; 721 } else { 722 bi->freq[bi->num_freq++] = freq; 723 } 724 725 if (*pos == ';' || *pos == '\0') 726 break; 727 if (*pos != ',') 728 goto fail; 729 pos++; 730 } 731 732 return 0; 733 fail: 734 wpa_printf(MSG_DEBUG, "DPP: Invalid URI channel-list"); 735 return -1; 736 } 737 738 739 int dpp_parse_uri_mac(struct dpp_bootstrap_info *bi, const char *mac) 740 { 741 if (!mac) 742 return 0; 743 744 if (hwaddr_aton2(mac, bi->mac_addr) < 0) { 745 wpa_printf(MSG_DEBUG, "DPP: Invalid URI mac"); 746 return -1; 747 } 748 749 wpa_printf(MSG_DEBUG, "DPP: URI mac: " MACSTR, MAC2STR(bi->mac_addr)); 750 751 return 0; 752 } 753 754 755 int dpp_parse_uri_info(struct dpp_bootstrap_info *bi, const char *info) 756 { 757 const char *end; 758 759 if (!info) 760 return 0; 761 762 end = os_strchr(info, ';'); 763 if (!end) 764 end = info + os_strlen(info); 765 bi->info = os_malloc(end - info + 1); 766 if (!bi->info) 767 return -1; 768 os_memcpy(bi->info, info, end - info); 769 bi->info[end - info] = '\0'; 770 wpa_printf(MSG_DEBUG, "DPP: URI(information): %s", bi->info); 771 if (!dpp_uri_valid_info(bi->info)) { 772 wpa_printf(MSG_DEBUG, "DPP: Invalid URI information payload"); 773 return -1; 774 } 775 776 return 0; 777 } 778 779 780 static const struct dpp_curve_params * 781 dpp_get_curve_oid(const ASN1_OBJECT *poid) 782 { 783 ASN1_OBJECT *oid; 784 int i; 785 786 for (i = 0; dpp_curves[i].name; i++) { 787 oid = OBJ_txt2obj(dpp_curves[i].name, 0); 788 if (oid && OBJ_cmp(poid, oid) == 0) 789 return &dpp_curves[i]; 790 } 791 return NULL; 792 } 793 794 795 static const struct dpp_curve_params * dpp_get_curve_nid(int nid) 796 { 797 int i, tmp; 798 799 if (!nid) 800 return NULL; 801 for (i = 0; dpp_curves[i].name; i++) { 802 tmp = OBJ_txt2nid(dpp_curves[i].name); 803 if (tmp == nid) 804 return &dpp_curves[i]; 805 } 806 return NULL; 807 } 808 809 810 static int dpp_parse_uri_pk(struct dpp_bootstrap_info *bi, const char *info) 811 { 812 const char *end; 813 u8 *data; 814 size_t data_len; 815 EVP_PKEY *pkey; 816 const unsigned char *p; 817 int res; 818 X509_PUBKEY *pub = NULL; 819 ASN1_OBJECT *ppkalg; 820 const unsigned char *pk; 821 int ppklen; 822 X509_ALGOR *pa; 823 #if OPENSSL_VERSION_NUMBER < 0x10100000L || \ 824 (defined(LIBRESSL_VERSION_NUMBER) && \ 825 LIBRESSL_VERSION_NUMBER < 0x20800000L) 826 ASN1_OBJECT *pa_oid; 827 #else 828 const ASN1_OBJECT *pa_oid; 829 #endif 830 const void *pval; 831 int ptype; 832 const ASN1_OBJECT *poid; 833 char buf[100]; 834 835 end = os_strchr(info, ';'); 836 if (!end) 837 return -1; 838 839 data = base64_decode((const unsigned char *) info, end - info, 840 &data_len); 841 if (!data) { 842 wpa_printf(MSG_DEBUG, 843 "DPP: Invalid base64 encoding on URI public-key"); 844 return -1; 845 } 846 wpa_hexdump(MSG_DEBUG, "DPP: Base64 decoded URI public-key", 847 data, data_len); 848 849 if (sha256_vector(1, (const u8 **) &data, &data_len, 850 bi->pubkey_hash) < 0) { 851 wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); 852 os_free(data); 853 return -1; 854 } 855 wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", 856 bi->pubkey_hash, SHA256_MAC_LEN); 857 858 /* DER encoded ASN.1 SubjectPublicKeyInfo 859 * 860 * SubjectPublicKeyInfo ::= SEQUENCE { 861 * algorithm AlgorithmIdentifier, 862 * subjectPublicKey BIT STRING } 863 * 864 * AlgorithmIdentifier ::= SEQUENCE { 865 * algorithm OBJECT IDENTIFIER, 866 * parameters ANY DEFINED BY algorithm OPTIONAL } 867 * 868 * subjectPublicKey = compressed format public key per ANSI X9.63 869 * algorithm = ecPublicKey (1.2.840.10045.2.1) 870 * parameters = shall be present and shall be OBJECT IDENTIFIER; e.g., 871 * prime256v1 (1.2.840.10045.3.1.7) 872 */ 873 874 p = data; 875 pkey = d2i_PUBKEY(NULL, &p, data_len); 876 os_free(data); 877 878 if (!pkey) { 879 wpa_printf(MSG_DEBUG, 880 "DPP: Could not parse URI public-key SubjectPublicKeyInfo"); 881 return -1; 882 } 883 884 if (EVP_PKEY_type(EVP_PKEY_id(pkey)) != EVP_PKEY_EC) { 885 wpa_printf(MSG_DEBUG, 886 "DPP: SubjectPublicKeyInfo does not describe an EC key"); 887 EVP_PKEY_free(pkey); 888 return -1; 889 } 890 891 res = X509_PUBKEY_set(&pub, pkey); 892 if (res != 1) { 893 wpa_printf(MSG_DEBUG, "DPP: Could not set pubkey"); 894 goto fail; 895 } 896 897 res = X509_PUBKEY_get0_param(&ppkalg, &pk, &ppklen, &pa, pub); 898 if (res != 1) { 899 wpa_printf(MSG_DEBUG, 900 "DPP: Could not extract SubjectPublicKeyInfo parameters"); 901 goto fail; 902 } 903 res = OBJ_obj2txt(buf, sizeof(buf), ppkalg, 0); 904 if (res < 0 || (size_t) res >= sizeof(buf)) { 905 wpa_printf(MSG_DEBUG, 906 "DPP: Could not extract SubjectPublicKeyInfo algorithm"); 907 goto fail; 908 } 909 wpa_printf(MSG_DEBUG, "DPP: URI subjectPublicKey algorithm: %s", buf); 910 if (os_strcmp(buf, "id-ecPublicKey") != 0) { 911 wpa_printf(MSG_DEBUG, 912 "DPP: Unsupported SubjectPublicKeyInfo algorithm"); 913 goto fail; 914 } 915 916 X509_ALGOR_get0(&pa_oid, &ptype, (void *) &pval, pa); 917 if (ptype != V_ASN1_OBJECT) { 918 wpa_printf(MSG_DEBUG, 919 "DPP: SubjectPublicKeyInfo parameters did not contain an OID"); 920 goto fail; 921 } 922 poid = pval; 923 res = OBJ_obj2txt(buf, sizeof(buf), poid, 0); 924 if (res < 0 || (size_t) res >= sizeof(buf)) { 925 wpa_printf(MSG_DEBUG, 926 "DPP: Could not extract SubjectPublicKeyInfo parameters OID"); 927 goto fail; 928 } 929 wpa_printf(MSG_DEBUG, "DPP: URI subjectPublicKey parameters: %s", buf); 930 bi->curve = dpp_get_curve_oid(poid); 931 if (!bi->curve) { 932 wpa_printf(MSG_DEBUG, 933 "DPP: Unsupported SubjectPublicKeyInfo curve: %s", 934 buf); 935 goto fail; 936 } 937 938 wpa_hexdump(MSG_DEBUG, "DPP: URI subjectPublicKey", pk, ppklen); 939 940 X509_PUBKEY_free(pub); 941 bi->pubkey = pkey; 942 return 0; 943 fail: 944 X509_PUBKEY_free(pub); 945 EVP_PKEY_free(pkey); 946 return -1; 947 } 948 949 950 static struct dpp_bootstrap_info * dpp_parse_uri(const char *uri) 951 { 952 const char *pos = uri; 953 const char *end; 954 const char *chan_list = NULL, *mac = NULL, *info = NULL, *pk = NULL; 955 struct dpp_bootstrap_info *bi; 956 957 wpa_hexdump_ascii(MSG_DEBUG, "DPP: URI", uri, os_strlen(uri)); 958 959 if (os_strncmp(pos, "DPP:", 4) != 0) { 960 wpa_printf(MSG_INFO, "DPP: Not a DPP URI"); 961 return NULL; 962 } 963 pos += 4; 964 965 for (;;) { 966 end = os_strchr(pos, ';'); 967 if (!end) 968 break; 969 970 if (end == pos) { 971 /* Handle terminating ";;" and ignore unexpected ";" 972 * for parsing robustness. */ 973 pos++; 974 continue; 975 } 976 977 if (pos[0] == 'C' && pos[1] == ':' && !chan_list) 978 chan_list = pos + 2; 979 else if (pos[0] == 'M' && pos[1] == ':' && !mac) 980 mac = pos + 2; 981 else if (pos[0] == 'I' && pos[1] == ':' && !info) 982 info = pos + 2; 983 else if (pos[0] == 'K' && pos[1] == ':' && !pk) 984 pk = pos + 2; 985 else 986 wpa_hexdump_ascii(MSG_DEBUG, 987 "DPP: Ignore unrecognized URI parameter", 988 pos, end - pos); 989 pos = end + 1; 990 } 991 992 if (!pk) { 993 wpa_printf(MSG_INFO, "DPP: URI missing public-key"); 994 return NULL; 995 } 996 997 bi = os_zalloc(sizeof(*bi)); 998 if (!bi) 999 return NULL; 1000 1001 if (dpp_clone_uri(bi, uri) < 0 || 1002 dpp_parse_uri_chan_list(bi, chan_list) < 0 || 1003 dpp_parse_uri_mac(bi, mac) < 0 || 1004 dpp_parse_uri_info(bi, info) < 0 || 1005 dpp_parse_uri_pk(bi, pk) < 0) { 1006 dpp_bootstrap_info_free(bi); 1007 bi = NULL; 1008 } 1009 1010 return bi; 1011 } 1012 1013 1014 struct dpp_bootstrap_info * dpp_parse_qr_code(const char *uri) 1015 { 1016 struct dpp_bootstrap_info *bi; 1017 1018 bi = dpp_parse_uri(uri); 1019 if (bi) 1020 bi->type = DPP_BOOTSTRAP_QR_CODE; 1021 return bi; 1022 } 1023 1024 1025 static void dpp_debug_print_key(const char *title, EVP_PKEY *key) 1026 { 1027 EC_KEY *eckey; 1028 BIO *out; 1029 size_t rlen; 1030 char *txt; 1031 int res; 1032 unsigned char *der = NULL; 1033 int der_len; 1034 const EC_GROUP *group; 1035 const EC_POINT *point; 1036 1037 out = BIO_new(BIO_s_mem()); 1038 if (!out) 1039 return; 1040 1041 EVP_PKEY_print_private(out, key, 0, NULL); 1042 rlen = BIO_ctrl_pending(out); 1043 txt = os_malloc(rlen + 1); 1044 if (txt) { 1045 res = BIO_read(out, txt, rlen); 1046 if (res > 0) { 1047 txt[res] = '\0'; 1048 wpa_printf(MSG_DEBUG, "%s: %s", title, txt); 1049 } 1050 os_free(txt); 1051 } 1052 BIO_free(out); 1053 1054 eckey = EVP_PKEY_get1_EC_KEY(key); 1055 if (!eckey) 1056 return; 1057 1058 group = EC_KEY_get0_group(eckey); 1059 point = EC_KEY_get0_public_key(eckey); 1060 if (group && point) 1061 dpp_debug_print_point(title, group, point); 1062 1063 der_len = i2d_ECPrivateKey(eckey, &der); 1064 if (der_len > 0) 1065 wpa_hexdump_key(MSG_DEBUG, "DPP: ECPrivateKey", der, der_len); 1066 OPENSSL_free(der); 1067 if (der_len <= 0) { 1068 der = NULL; 1069 der_len = i2d_EC_PUBKEY(eckey, &der); 1070 if (der_len > 0) 1071 wpa_hexdump(MSG_DEBUG, "DPP: EC_PUBKEY", der, der_len); 1072 OPENSSL_free(der); 1073 } 1074 1075 EC_KEY_free(eckey); 1076 } 1077 1078 1079 static EVP_PKEY * dpp_gen_keypair(const struct dpp_curve_params *curve) 1080 { 1081 EVP_PKEY_CTX *kctx = NULL; 1082 EC_KEY *ec_params; 1083 EVP_PKEY *params = NULL, *key = NULL; 1084 int nid; 1085 1086 wpa_printf(MSG_DEBUG, "DPP: Generating a keypair"); 1087 1088 nid = OBJ_txt2nid(curve->name); 1089 if (nid == NID_undef) { 1090 wpa_printf(MSG_INFO, "DPP: Unsupported curve %s", curve->name); 1091 return NULL; 1092 } 1093 1094 ec_params = EC_KEY_new_by_curve_name(nid); 1095 if (!ec_params) { 1096 wpa_printf(MSG_ERROR, 1097 "DPP: Failed to generate EC_KEY parameters"); 1098 goto fail; 1099 } 1100 EC_KEY_set_asn1_flag(ec_params, OPENSSL_EC_NAMED_CURVE); 1101 params = EVP_PKEY_new(); 1102 if (!params || EVP_PKEY_set1_EC_KEY(params, ec_params) != 1) { 1103 wpa_printf(MSG_ERROR, 1104 "DPP: Failed to generate EVP_PKEY parameters"); 1105 goto fail; 1106 } 1107 1108 kctx = EVP_PKEY_CTX_new(params, NULL); 1109 if (!kctx || 1110 EVP_PKEY_keygen_init(kctx) != 1 || 1111 EVP_PKEY_keygen(kctx, &key) != 1) { 1112 wpa_printf(MSG_ERROR, "DPP: Failed to generate EC key"); 1113 goto fail; 1114 } 1115 1116 if (wpa_debug_show_keys) 1117 dpp_debug_print_key("Own generated key", key); 1118 1119 EVP_PKEY_free(params); 1120 EVP_PKEY_CTX_free(kctx); 1121 return key; 1122 fail: 1123 EVP_PKEY_CTX_free(kctx); 1124 EVP_PKEY_free(params); 1125 return NULL; 1126 } 1127 1128 1129 static const struct dpp_curve_params * 1130 dpp_get_curve_name(const char *name) 1131 { 1132 int i; 1133 1134 for (i = 0; dpp_curves[i].name; i++) { 1135 if (os_strcmp(name, dpp_curves[i].name) == 0 || 1136 (dpp_curves[i].jwk_crv && 1137 os_strcmp(name, dpp_curves[i].jwk_crv) == 0)) 1138 return &dpp_curves[i]; 1139 } 1140 return NULL; 1141 } 1142 1143 1144 static const struct dpp_curve_params * 1145 dpp_get_curve_jwk_crv(const char *name) 1146 { 1147 int i; 1148 1149 for (i = 0; dpp_curves[i].name; i++) { 1150 if (dpp_curves[i].jwk_crv && 1151 os_strcmp(name, dpp_curves[i].jwk_crv) == 0) 1152 return &dpp_curves[i]; 1153 } 1154 return NULL; 1155 } 1156 1157 1158 static EVP_PKEY * dpp_set_keypair(const struct dpp_curve_params **curve, 1159 const u8 *privkey, size_t privkey_len) 1160 { 1161 EVP_PKEY *pkey; 1162 EC_KEY *eckey; 1163 const EC_GROUP *group; 1164 int nid; 1165 1166 pkey = EVP_PKEY_new(); 1167 if (!pkey) 1168 return NULL; 1169 eckey = d2i_ECPrivateKey(NULL, &privkey, privkey_len); 1170 if (!eckey) { 1171 wpa_printf(MSG_INFO, 1172 "DPP: OpenSSL: d2i_ECPrivateKey() failed: %s", 1173 ERR_error_string(ERR_get_error(), NULL)); 1174 EVP_PKEY_free(pkey); 1175 return NULL; 1176 } 1177 group = EC_KEY_get0_group(eckey); 1178 if (!group) { 1179 EC_KEY_free(eckey); 1180 EVP_PKEY_free(pkey); 1181 return NULL; 1182 } 1183 nid = EC_GROUP_get_curve_name(group); 1184 *curve = dpp_get_curve_nid(nid); 1185 if (!*curve) { 1186 wpa_printf(MSG_INFO, 1187 "DPP: Unsupported curve (nid=%d) in pre-assigned key", 1188 nid); 1189 EC_KEY_free(eckey); 1190 EVP_PKEY_free(pkey); 1191 return NULL; 1192 } 1193 1194 if (EVP_PKEY_assign_EC_KEY(pkey, eckey) != 1) { 1195 EC_KEY_free(eckey); 1196 EVP_PKEY_free(pkey); 1197 return NULL; 1198 } 1199 return pkey; 1200 } 1201 1202 1203 typedef struct { 1204 /* AlgorithmIdentifier ecPublicKey with optional parameters present 1205 * as an OID identifying the curve */ 1206 X509_ALGOR *alg; 1207 /* Compressed format public key per ANSI X9.63 */ 1208 ASN1_BIT_STRING *pub_key; 1209 } DPP_BOOTSTRAPPING_KEY; 1210 1211 ASN1_SEQUENCE(DPP_BOOTSTRAPPING_KEY) = { 1212 ASN1_SIMPLE(DPP_BOOTSTRAPPING_KEY, alg, X509_ALGOR), 1213 ASN1_SIMPLE(DPP_BOOTSTRAPPING_KEY, pub_key, ASN1_BIT_STRING) 1214 } ASN1_SEQUENCE_END(DPP_BOOTSTRAPPING_KEY); 1215 1216 IMPLEMENT_ASN1_FUNCTIONS(DPP_BOOTSTRAPPING_KEY); 1217 1218 1219 static struct wpabuf * dpp_bootstrap_key_der(EVP_PKEY *key) 1220 { 1221 unsigned char *der = NULL; 1222 int der_len; 1223 EC_KEY *eckey; 1224 struct wpabuf *ret = NULL; 1225 size_t len; 1226 const EC_GROUP *group; 1227 const EC_POINT *point; 1228 BN_CTX *ctx; 1229 DPP_BOOTSTRAPPING_KEY *bootstrap = NULL; 1230 int nid; 1231 1232 ctx = BN_CTX_new(); 1233 eckey = EVP_PKEY_get1_EC_KEY(key); 1234 if (!ctx || !eckey) 1235 goto fail; 1236 1237 group = EC_KEY_get0_group(eckey); 1238 point = EC_KEY_get0_public_key(eckey); 1239 if (!group || !point) 1240 goto fail; 1241 dpp_debug_print_point("DPP: bootstrap public key", group, point); 1242 nid = EC_GROUP_get_curve_name(group); 1243 1244 bootstrap = DPP_BOOTSTRAPPING_KEY_new(); 1245 if (!bootstrap || 1246 X509_ALGOR_set0(bootstrap->alg, OBJ_nid2obj(EVP_PKEY_EC), 1247 V_ASN1_OBJECT, (void *) OBJ_nid2obj(nid)) != 1) 1248 goto fail; 1249 1250 len = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, 1251 NULL, 0, ctx); 1252 if (len == 0) 1253 goto fail; 1254 1255 der = OPENSSL_malloc(len); 1256 if (!der) 1257 goto fail; 1258 len = EC_POINT_point2oct(group, point, POINT_CONVERSION_COMPRESSED, 1259 der, len, ctx); 1260 1261 OPENSSL_free(bootstrap->pub_key->data); 1262 bootstrap->pub_key->data = der; 1263 der = NULL; 1264 bootstrap->pub_key->length = len; 1265 /* No unused bits */ 1266 bootstrap->pub_key->flags &= ~(ASN1_STRING_FLAG_BITS_LEFT | 0x07); 1267 bootstrap->pub_key->flags |= ASN1_STRING_FLAG_BITS_LEFT; 1268 1269 der_len = i2d_DPP_BOOTSTRAPPING_KEY(bootstrap, &der); 1270 if (der_len <= 0) { 1271 wpa_printf(MSG_ERROR, 1272 "DDP: Failed to build DER encoded public key"); 1273 goto fail; 1274 } 1275 1276 ret = wpabuf_alloc_copy(der, der_len); 1277 fail: 1278 DPP_BOOTSTRAPPING_KEY_free(bootstrap); 1279 OPENSSL_free(der); 1280 EC_KEY_free(eckey); 1281 BN_CTX_free(ctx); 1282 return ret; 1283 } 1284 1285 1286 int dpp_bootstrap_key_hash(struct dpp_bootstrap_info *bi) 1287 { 1288 struct wpabuf *der; 1289 int res; 1290 const u8 *addr[1]; 1291 size_t len[1]; 1292 1293 der = dpp_bootstrap_key_der(bi->pubkey); 1294 if (!der) 1295 return -1; 1296 wpa_hexdump_buf(MSG_DEBUG, "DPP: Compressed public key (DER)", 1297 der); 1298 1299 addr[0] = wpabuf_head(der); 1300 len[0] = wpabuf_len(der); 1301 res = sha256_vector(1, addr, len, bi->pubkey_hash); 1302 if (res < 0) 1303 wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); 1304 else 1305 wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", bi->pubkey_hash, 1306 SHA256_MAC_LEN); 1307 wpabuf_free(der); 1308 return res; 1309 } 1310 1311 1312 char * dpp_keygen(struct dpp_bootstrap_info *bi, const char *curve, 1313 const u8 *privkey, size_t privkey_len) 1314 { 1315 unsigned char *base64 = NULL; 1316 char *pos, *end; 1317 size_t len; 1318 struct wpabuf *der = NULL; 1319 const u8 *addr[1]; 1320 int res; 1321 1322 if (!curve) { 1323 bi->curve = &dpp_curves[0]; 1324 } else { 1325 bi->curve = dpp_get_curve_name(curve); 1326 if (!bi->curve) { 1327 wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", 1328 curve); 1329 return NULL; 1330 } 1331 } 1332 if (privkey) 1333 bi->pubkey = dpp_set_keypair(&bi->curve, privkey, privkey_len); 1334 else 1335 bi->pubkey = dpp_gen_keypair(bi->curve); 1336 if (!bi->pubkey) 1337 goto fail; 1338 bi->own = 1; 1339 1340 der = dpp_bootstrap_key_der(bi->pubkey); 1341 if (!der) 1342 goto fail; 1343 wpa_hexdump_buf(MSG_DEBUG, "DPP: Compressed public key (DER)", 1344 der); 1345 1346 addr[0] = wpabuf_head(der); 1347 len = wpabuf_len(der); 1348 res = sha256_vector(1, addr, &len, bi->pubkey_hash); 1349 if (res < 0) { 1350 wpa_printf(MSG_DEBUG, "DPP: Failed to hash public key"); 1351 goto fail; 1352 } 1353 wpa_hexdump(MSG_DEBUG, "DPP: Public key hash", bi->pubkey_hash, 1354 SHA256_MAC_LEN); 1355 1356 base64 = base64_encode(wpabuf_head(der), wpabuf_len(der), &len); 1357 wpabuf_free(der); 1358 der = NULL; 1359 if (!base64) 1360 goto fail; 1361 pos = (char *) base64; 1362 end = pos + len; 1363 for (;;) { 1364 pos = os_strchr(pos, '\n'); 1365 if (!pos) 1366 break; 1367 os_memmove(pos, pos + 1, end - pos); 1368 } 1369 return (char *) base64; 1370 fail: 1371 os_free(base64); 1372 wpabuf_free(der); 1373 return NULL; 1374 } 1375 1376 1377 static int dpp_derive_k1(const u8 *Mx, size_t Mx_len, u8 *k1, 1378 unsigned int hash_len) 1379 { 1380 u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; 1381 const char *info = "first intermediate key"; 1382 int res; 1383 1384 /* k1 = HKDF(<>, "first intermediate key", M.x) */ 1385 1386 /* HKDF-Extract(<>, M.x) */ 1387 os_memset(salt, 0, hash_len); 1388 if (dpp_hmac(hash_len, salt, hash_len, Mx, Mx_len, prk) < 0) 1389 return -1; 1390 wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM=M.x)", 1391 prk, hash_len); 1392 1393 /* HKDF-Expand(PRK, info, L) */ 1394 res = dpp_hkdf_expand(hash_len, prk, hash_len, info, k1, hash_len); 1395 os_memset(prk, 0, hash_len); 1396 if (res < 0) 1397 return -1; 1398 1399 wpa_hexdump_key(MSG_DEBUG, "DPP: k1 = HKDF-Expand(PRK, info, L)", 1400 k1, hash_len); 1401 return 0; 1402 } 1403 1404 1405 static int dpp_derive_k2(const u8 *Nx, size_t Nx_len, u8 *k2, 1406 unsigned int hash_len) 1407 { 1408 u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; 1409 const char *info = "second intermediate key"; 1410 int res; 1411 1412 /* k2 = HKDF(<>, "second intermediate key", N.x) */ 1413 1414 /* HKDF-Extract(<>, N.x) */ 1415 os_memset(salt, 0, hash_len); 1416 res = dpp_hmac(hash_len, salt, hash_len, Nx, Nx_len, prk); 1417 if (res < 0) 1418 return -1; 1419 wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM=N.x)", 1420 prk, hash_len); 1421 1422 /* HKDF-Expand(PRK, info, L) */ 1423 res = dpp_hkdf_expand(hash_len, prk, hash_len, info, k2, hash_len); 1424 os_memset(prk, 0, hash_len); 1425 if (res < 0) 1426 return -1; 1427 1428 wpa_hexdump_key(MSG_DEBUG, "DPP: k2 = HKDF-Expand(PRK, info, L)", 1429 k2, hash_len); 1430 return 0; 1431 } 1432 1433 1434 static int dpp_derive_ke(struct dpp_authentication *auth, u8 *ke, 1435 unsigned int hash_len) 1436 { 1437 size_t nonce_len; 1438 u8 nonces[2 * DPP_MAX_NONCE_LEN]; 1439 const char *info_ke = "DPP Key"; 1440 u8 prk[DPP_MAX_HASH_LEN]; 1441 int res; 1442 const u8 *addr[3]; 1443 size_t len[3]; 1444 size_t num_elem = 0; 1445 1446 if (!auth->Mx_len || !auth->Nx_len) { 1447 wpa_printf(MSG_DEBUG, 1448 "DPP: Mx/Nx not available - cannot derive ke"); 1449 return -1; 1450 } 1451 1452 /* ke = HKDF(I-nonce | R-nonce, "DPP Key", M.x | N.x [| L.x]) */ 1453 1454 /* HKDF-Extract(I-nonce | R-nonce, M.x | N.x [| L.x]) */ 1455 nonce_len = auth->curve->nonce_len; 1456 os_memcpy(nonces, auth->i_nonce, nonce_len); 1457 os_memcpy(&nonces[nonce_len], auth->r_nonce, nonce_len); 1458 addr[num_elem] = auth->Mx; 1459 len[num_elem] = auth->Mx_len; 1460 num_elem++; 1461 addr[num_elem] = auth->Nx; 1462 len[num_elem] = auth->Nx_len; 1463 num_elem++; 1464 if (auth->peer_bi && auth->own_bi) { 1465 if (!auth->Lx_len) { 1466 wpa_printf(MSG_DEBUG, 1467 "DPP: Lx not available - cannot derive ke"); 1468 return -1; 1469 } 1470 addr[num_elem] = auth->Lx; 1471 len[num_elem] = auth->secret_len; 1472 num_elem++; 1473 } 1474 res = dpp_hmac_vector(hash_len, nonces, 2 * nonce_len, 1475 num_elem, addr, len, prk); 1476 if (res < 0) 1477 return -1; 1478 wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM)", 1479 prk, hash_len); 1480 1481 /* HKDF-Expand(PRK, info, L) */ 1482 res = dpp_hkdf_expand(hash_len, prk, hash_len, info_ke, ke, hash_len); 1483 os_memset(prk, 0, hash_len); 1484 if (res < 0) 1485 return -1; 1486 1487 wpa_hexdump_key(MSG_DEBUG, "DPP: ke = HKDF-Expand(PRK, info, L)", 1488 ke, hash_len); 1489 return 0; 1490 } 1491 1492 1493 static void dpp_build_attr_status(struct wpabuf *msg, 1494 enum dpp_status_error status) 1495 { 1496 wpa_printf(MSG_DEBUG, "DPP: Status %d", status); 1497 wpabuf_put_le16(msg, DPP_ATTR_STATUS); 1498 wpabuf_put_le16(msg, 1); 1499 wpabuf_put_u8(msg, status); 1500 } 1501 1502 1503 static void dpp_build_attr_r_bootstrap_key_hash(struct wpabuf *msg, 1504 const u8 *hash) 1505 { 1506 if (hash) { 1507 wpa_printf(MSG_DEBUG, "DPP: R-Bootstrap Key Hash"); 1508 wpabuf_put_le16(msg, DPP_ATTR_R_BOOTSTRAP_KEY_HASH); 1509 wpabuf_put_le16(msg, SHA256_MAC_LEN); 1510 wpabuf_put_data(msg, hash, SHA256_MAC_LEN); 1511 } 1512 } 1513 1514 1515 static void dpp_build_attr_i_bootstrap_key_hash(struct wpabuf *msg, 1516 const u8 *hash) 1517 { 1518 if (hash) { 1519 wpa_printf(MSG_DEBUG, "DPP: I-Bootstrap Key Hash"); 1520 wpabuf_put_le16(msg, DPP_ATTR_I_BOOTSTRAP_KEY_HASH); 1521 wpabuf_put_le16(msg, SHA256_MAC_LEN); 1522 wpabuf_put_data(msg, hash, SHA256_MAC_LEN); 1523 } 1524 } 1525 1526 1527 static struct wpabuf * dpp_auth_build_req(struct dpp_authentication *auth, 1528 const struct wpabuf *pi, 1529 size_t nonce_len, 1530 const u8 *r_pubkey_hash, 1531 const u8 *i_pubkey_hash, 1532 unsigned int neg_freq) 1533 { 1534 struct wpabuf *msg; 1535 u8 clear[4 + DPP_MAX_NONCE_LEN + 4 + 1]; 1536 u8 wrapped_data[4 + DPP_MAX_NONCE_LEN + 4 + 1 + AES_BLOCK_SIZE]; 1537 u8 *pos; 1538 const u8 *addr[2]; 1539 size_t len[2], siv_len, attr_len; 1540 u8 *attr_start, *attr_end; 1541 1542 /* Build DPP Authentication Request frame attributes */ 1543 attr_len = 2 * (4 + SHA256_MAC_LEN) + 4 + (pi ? wpabuf_len(pi) : 0) + 1544 4 + sizeof(wrapped_data); 1545 if (neg_freq > 0) 1546 attr_len += 4 + 2; 1547 #ifdef CONFIG_DPP2 1548 attr_len += 5; 1549 #endif /* CONFIG_DPP2 */ 1550 #ifdef CONFIG_TESTING_OPTIONS 1551 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ) 1552 attr_len += 5; 1553 #endif /* CONFIG_TESTING_OPTIONS */ 1554 msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_REQ, attr_len); 1555 if (!msg) 1556 return NULL; 1557 1558 attr_start = wpabuf_put(msg, 0); 1559 1560 /* Responder Bootstrapping Key Hash */ 1561 dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); 1562 1563 /* Initiator Bootstrapping Key Hash */ 1564 dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); 1565 1566 /* Initiator Protocol Key */ 1567 if (pi) { 1568 wpabuf_put_le16(msg, DPP_ATTR_I_PROTOCOL_KEY); 1569 wpabuf_put_le16(msg, wpabuf_len(pi)); 1570 wpabuf_put_buf(msg, pi); 1571 } 1572 1573 /* Channel */ 1574 if (neg_freq > 0) { 1575 u8 op_class, channel; 1576 1577 if (ieee80211_freq_to_channel_ext(neg_freq, 0, 0, &op_class, 1578 &channel) == 1579 NUM_HOSTAPD_MODES) { 1580 wpa_printf(MSG_INFO, 1581 "DPP: Unsupported negotiation frequency request: %d", 1582 neg_freq); 1583 wpabuf_free(msg); 1584 return NULL; 1585 } 1586 wpabuf_put_le16(msg, DPP_ATTR_CHANNEL); 1587 wpabuf_put_le16(msg, 2); 1588 wpabuf_put_u8(msg, op_class); 1589 wpabuf_put_u8(msg, channel); 1590 } 1591 1592 #ifdef CONFIG_DPP2 1593 /* Protocol Version */ 1594 wpabuf_put_le16(msg, DPP_ATTR_PROTOCOL_VERSION); 1595 wpabuf_put_le16(msg, 1); 1596 wpabuf_put_u8(msg, 2); 1597 #endif /* CONFIG_DPP2 */ 1598 1599 #ifdef CONFIG_TESTING_OPTIONS 1600 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_REQ) { 1601 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 1602 goto skip_wrapped_data; 1603 } 1604 #endif /* CONFIG_TESTING_OPTIONS */ 1605 1606 /* Wrapped data ({I-nonce, I-capabilities}k1) */ 1607 pos = clear; 1608 1609 #ifdef CONFIG_TESTING_OPTIONS 1610 if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_REQ) { 1611 wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); 1612 goto skip_i_nonce; 1613 } 1614 if (dpp_test == DPP_TEST_INVALID_I_NONCE_AUTH_REQ) { 1615 wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-nonce"); 1616 WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); 1617 pos += 2; 1618 WPA_PUT_LE16(pos, nonce_len - 1); 1619 pos += 2; 1620 os_memcpy(pos, auth->i_nonce, nonce_len - 1); 1621 pos += nonce_len - 1; 1622 goto skip_i_nonce; 1623 } 1624 #endif /* CONFIG_TESTING_OPTIONS */ 1625 1626 /* I-nonce */ 1627 WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); 1628 pos += 2; 1629 WPA_PUT_LE16(pos, nonce_len); 1630 pos += 2; 1631 os_memcpy(pos, auth->i_nonce, nonce_len); 1632 pos += nonce_len; 1633 1634 #ifdef CONFIG_TESTING_OPTIONS 1635 skip_i_nonce: 1636 if (dpp_test == DPP_TEST_NO_I_CAPAB_AUTH_REQ) { 1637 wpa_printf(MSG_INFO, "DPP: TESTING - no I-capab"); 1638 goto skip_i_capab; 1639 } 1640 #endif /* CONFIG_TESTING_OPTIONS */ 1641 1642 /* I-capabilities */ 1643 WPA_PUT_LE16(pos, DPP_ATTR_I_CAPABILITIES); 1644 pos += 2; 1645 WPA_PUT_LE16(pos, 1); 1646 pos += 2; 1647 auth->i_capab = auth->allowed_roles; 1648 *pos++ = auth->i_capab; 1649 #ifdef CONFIG_TESTING_OPTIONS 1650 if (dpp_test == DPP_TEST_ZERO_I_CAPAB) { 1651 wpa_printf(MSG_INFO, "DPP: TESTING - zero I-capabilities"); 1652 pos[-1] = 0; 1653 } 1654 skip_i_capab: 1655 #endif /* CONFIG_TESTING_OPTIONS */ 1656 1657 attr_end = wpabuf_put(msg, 0); 1658 1659 /* OUI, OUI type, Crypto Suite, DPP frame type */ 1660 addr[0] = wpabuf_head_u8(msg) + 2; 1661 len[0] = 3 + 1 + 1 + 1; 1662 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 1663 1664 /* Attributes before Wrapped Data */ 1665 addr[1] = attr_start; 1666 len[1] = attr_end - attr_start; 1667 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 1668 1669 siv_len = pos - clear; 1670 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len); 1671 if (aes_siv_encrypt(auth->k1, auth->curve->hash_len, clear, siv_len, 1672 2, addr, len, wrapped_data) < 0) { 1673 wpabuf_free(msg); 1674 return NULL; 1675 } 1676 siv_len += AES_BLOCK_SIZE; 1677 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 1678 wrapped_data, siv_len); 1679 1680 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 1681 wpabuf_put_le16(msg, siv_len); 1682 wpabuf_put_data(msg, wrapped_data, siv_len); 1683 1684 #ifdef CONFIG_TESTING_OPTIONS 1685 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_REQ) { 1686 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 1687 dpp_build_attr_status(msg, DPP_STATUS_OK); 1688 } 1689 skip_wrapped_data: 1690 #endif /* CONFIG_TESTING_OPTIONS */ 1691 1692 wpa_hexdump_buf(MSG_DEBUG, 1693 "DPP: Authentication Request frame attributes", msg); 1694 1695 return msg; 1696 } 1697 1698 1699 static struct wpabuf * dpp_auth_build_resp(struct dpp_authentication *auth, 1700 enum dpp_status_error status, 1701 const struct wpabuf *pr, 1702 size_t nonce_len, 1703 const u8 *r_pubkey_hash, 1704 const u8 *i_pubkey_hash, 1705 const u8 *r_nonce, const u8 *i_nonce, 1706 const u8 *wrapped_r_auth, 1707 size_t wrapped_r_auth_len, 1708 const u8 *siv_key) 1709 { 1710 struct wpabuf *msg; 1711 #define DPP_AUTH_RESP_CLEAR_LEN 2 * (4 + DPP_MAX_NONCE_LEN) + 4 + 1 + \ 1712 4 + 4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE 1713 u8 clear[DPP_AUTH_RESP_CLEAR_LEN]; 1714 u8 wrapped_data[DPP_AUTH_RESP_CLEAR_LEN + AES_BLOCK_SIZE]; 1715 const u8 *addr[2]; 1716 size_t len[2], siv_len, attr_len; 1717 u8 *attr_start, *attr_end, *pos; 1718 1719 auth->waiting_auth_conf = 1; 1720 auth->auth_resp_tries = 0; 1721 1722 /* Build DPP Authentication Response frame attributes */ 1723 attr_len = 4 + 1 + 2 * (4 + SHA256_MAC_LEN) + 1724 4 + (pr ? wpabuf_len(pr) : 0) + 4 + sizeof(wrapped_data); 1725 #ifdef CONFIG_DPP2 1726 attr_len += 5; 1727 #endif /* CONFIG_DPP2 */ 1728 #ifdef CONFIG_TESTING_OPTIONS 1729 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP) 1730 attr_len += 5; 1731 #endif /* CONFIG_TESTING_OPTIONS */ 1732 msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_RESP, attr_len); 1733 if (!msg) 1734 return NULL; 1735 1736 attr_start = wpabuf_put(msg, 0); 1737 1738 /* DPP Status */ 1739 if (status != 255) 1740 dpp_build_attr_status(msg, status); 1741 1742 /* Responder Bootstrapping Key Hash */ 1743 dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); 1744 1745 /* Initiator Bootstrapping Key Hash (mutual authentication) */ 1746 dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); 1747 1748 /* Responder Protocol Key */ 1749 if (pr) { 1750 wpabuf_put_le16(msg, DPP_ATTR_R_PROTOCOL_KEY); 1751 wpabuf_put_le16(msg, wpabuf_len(pr)); 1752 wpabuf_put_buf(msg, pr); 1753 } 1754 1755 #ifdef CONFIG_DPP2 1756 /* Protocol Version */ 1757 wpabuf_put_le16(msg, DPP_ATTR_PROTOCOL_VERSION); 1758 wpabuf_put_le16(msg, 1); 1759 wpabuf_put_u8(msg, 2); 1760 #endif /* CONFIG_DPP2 */ 1761 1762 attr_end = wpabuf_put(msg, 0); 1763 1764 #ifdef CONFIG_TESTING_OPTIONS 1765 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_RESP) { 1766 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 1767 goto skip_wrapped_data; 1768 } 1769 #endif /* CONFIG_TESTING_OPTIONS */ 1770 1771 /* Wrapped data ({R-nonce, I-nonce, R-capabilities, {R-auth}ke}k2) */ 1772 pos = clear; 1773 1774 if (r_nonce) { 1775 /* R-nonce */ 1776 WPA_PUT_LE16(pos, DPP_ATTR_R_NONCE); 1777 pos += 2; 1778 WPA_PUT_LE16(pos, nonce_len); 1779 pos += 2; 1780 os_memcpy(pos, r_nonce, nonce_len); 1781 pos += nonce_len; 1782 } 1783 1784 if (i_nonce) { 1785 /* I-nonce */ 1786 WPA_PUT_LE16(pos, DPP_ATTR_I_NONCE); 1787 pos += 2; 1788 WPA_PUT_LE16(pos, nonce_len); 1789 pos += 2; 1790 os_memcpy(pos, i_nonce, nonce_len); 1791 #ifdef CONFIG_TESTING_OPTIONS 1792 if (dpp_test == DPP_TEST_I_NONCE_MISMATCH_AUTH_RESP) { 1793 wpa_printf(MSG_INFO, "DPP: TESTING - I-nonce mismatch"); 1794 pos[nonce_len / 2] ^= 0x01; 1795 } 1796 #endif /* CONFIG_TESTING_OPTIONS */ 1797 pos += nonce_len; 1798 } 1799 1800 #ifdef CONFIG_TESTING_OPTIONS 1801 if (dpp_test == DPP_TEST_NO_R_CAPAB_AUTH_RESP) { 1802 wpa_printf(MSG_INFO, "DPP: TESTING - no R-capab"); 1803 goto skip_r_capab; 1804 } 1805 #endif /* CONFIG_TESTING_OPTIONS */ 1806 1807 /* R-capabilities */ 1808 WPA_PUT_LE16(pos, DPP_ATTR_R_CAPABILITIES); 1809 pos += 2; 1810 WPA_PUT_LE16(pos, 1); 1811 pos += 2; 1812 auth->r_capab = auth->configurator ? DPP_CAPAB_CONFIGURATOR : 1813 DPP_CAPAB_ENROLLEE; 1814 *pos++ = auth->r_capab; 1815 #ifdef CONFIG_TESTING_OPTIONS 1816 if (dpp_test == DPP_TEST_ZERO_R_CAPAB) { 1817 wpa_printf(MSG_INFO, "DPP: TESTING - zero R-capabilities"); 1818 pos[-1] = 0; 1819 } else if (dpp_test == DPP_TEST_INCOMPATIBLE_R_CAPAB_AUTH_RESP) { 1820 wpa_printf(MSG_INFO, 1821 "DPP: TESTING - incompatible R-capabilities"); 1822 if ((auth->i_capab & DPP_CAPAB_ROLE_MASK) == 1823 (DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE)) 1824 pos[-1] = 0; 1825 else 1826 pos[-1] = auth->configurator ? DPP_CAPAB_ENROLLEE : 1827 DPP_CAPAB_CONFIGURATOR; 1828 } 1829 skip_r_capab: 1830 #endif /* CONFIG_TESTING_OPTIONS */ 1831 1832 if (wrapped_r_auth) { 1833 /* {R-auth}ke */ 1834 WPA_PUT_LE16(pos, DPP_ATTR_WRAPPED_DATA); 1835 pos += 2; 1836 WPA_PUT_LE16(pos, wrapped_r_auth_len); 1837 pos += 2; 1838 os_memcpy(pos, wrapped_r_auth, wrapped_r_auth_len); 1839 pos += wrapped_r_auth_len; 1840 } 1841 1842 /* OUI, OUI type, Crypto Suite, DPP frame type */ 1843 addr[0] = wpabuf_head_u8(msg) + 2; 1844 len[0] = 3 + 1 + 1 + 1; 1845 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 1846 1847 /* Attributes before Wrapped Data */ 1848 addr[1] = attr_start; 1849 len[1] = attr_end - attr_start; 1850 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 1851 1852 siv_len = pos - clear; 1853 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", clear, siv_len); 1854 if (aes_siv_encrypt(siv_key, auth->curve->hash_len, clear, siv_len, 1855 2, addr, len, wrapped_data) < 0) { 1856 wpabuf_free(msg); 1857 return NULL; 1858 } 1859 siv_len += AES_BLOCK_SIZE; 1860 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 1861 wrapped_data, siv_len); 1862 1863 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 1864 wpabuf_put_le16(msg, siv_len); 1865 wpabuf_put_data(msg, wrapped_data, siv_len); 1866 1867 #ifdef CONFIG_TESTING_OPTIONS 1868 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_RESP) { 1869 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 1870 dpp_build_attr_status(msg, DPP_STATUS_OK); 1871 } 1872 skip_wrapped_data: 1873 #endif /* CONFIG_TESTING_OPTIONS */ 1874 1875 wpa_hexdump_buf(MSG_DEBUG, 1876 "DPP: Authentication Response frame attributes", msg); 1877 return msg; 1878 } 1879 1880 1881 static int dpp_channel_ok_init(struct hostapd_hw_modes *own_modes, 1882 u16 num_modes, unsigned int freq) 1883 { 1884 u16 m; 1885 int c, flag; 1886 1887 if (!own_modes || !num_modes) 1888 return 1; 1889 1890 for (m = 0; m < num_modes; m++) { 1891 for (c = 0; c < own_modes[m].num_channels; c++) { 1892 if ((unsigned int) own_modes[m].channels[c].freq != 1893 freq) 1894 continue; 1895 flag = own_modes[m].channels[c].flag; 1896 if (!(flag & (HOSTAPD_CHAN_DISABLED | 1897 HOSTAPD_CHAN_NO_IR | 1898 HOSTAPD_CHAN_RADAR))) 1899 return 1; 1900 } 1901 } 1902 1903 wpa_printf(MSG_DEBUG, "DPP: Peer channel %u MHz not supported", freq); 1904 return 0; 1905 } 1906 1907 1908 static int freq_included(const unsigned int freqs[], unsigned int num, 1909 unsigned int freq) 1910 { 1911 while (num > 0) { 1912 if (freqs[--num] == freq) 1913 return 1; 1914 } 1915 return 0; 1916 } 1917 1918 1919 static void freq_to_start(unsigned int freqs[], unsigned int num, 1920 unsigned int freq) 1921 { 1922 unsigned int i; 1923 1924 for (i = 0; i < num; i++) { 1925 if (freqs[i] == freq) 1926 break; 1927 } 1928 if (i == 0 || i >= num) 1929 return; 1930 os_memmove(&freqs[1], &freqs[0], i * sizeof(freqs[0])); 1931 freqs[0] = freq; 1932 } 1933 1934 1935 static int dpp_channel_intersect(struct dpp_authentication *auth, 1936 struct hostapd_hw_modes *own_modes, 1937 u16 num_modes) 1938 { 1939 struct dpp_bootstrap_info *peer_bi = auth->peer_bi; 1940 unsigned int i, freq; 1941 1942 for (i = 0; i < peer_bi->num_freq; i++) { 1943 freq = peer_bi->freq[i]; 1944 if (freq_included(auth->freq, auth->num_freq, freq)) 1945 continue; 1946 if (dpp_channel_ok_init(own_modes, num_modes, freq)) 1947 auth->freq[auth->num_freq++] = freq; 1948 } 1949 if (!auth->num_freq) { 1950 wpa_printf(MSG_INFO, 1951 "DPP: No available channels for initiating DPP Authentication"); 1952 return -1; 1953 } 1954 auth->curr_freq = auth->freq[0]; 1955 return 0; 1956 } 1957 1958 1959 static int dpp_channel_local_list(struct dpp_authentication *auth, 1960 struct hostapd_hw_modes *own_modes, 1961 u16 num_modes) 1962 { 1963 u16 m; 1964 int c, flag; 1965 unsigned int freq; 1966 1967 auth->num_freq = 0; 1968 1969 if (!own_modes || !num_modes) { 1970 auth->freq[0] = 2412; 1971 auth->freq[1] = 2437; 1972 auth->freq[2] = 2462; 1973 auth->num_freq = 3; 1974 return 0; 1975 } 1976 1977 for (m = 0; m < num_modes; m++) { 1978 for (c = 0; c < own_modes[m].num_channels; c++) { 1979 freq = own_modes[m].channels[c].freq; 1980 flag = own_modes[m].channels[c].flag; 1981 if (flag & (HOSTAPD_CHAN_DISABLED | 1982 HOSTAPD_CHAN_NO_IR | 1983 HOSTAPD_CHAN_RADAR)) 1984 continue; 1985 if (freq_included(auth->freq, auth->num_freq, freq)) 1986 continue; 1987 auth->freq[auth->num_freq++] = freq; 1988 if (auth->num_freq == DPP_BOOTSTRAP_MAX_FREQ) { 1989 m = num_modes; 1990 break; 1991 } 1992 } 1993 } 1994 1995 return auth->num_freq == 0 ? -1 : 0; 1996 } 1997 1998 1999 static int dpp_prepare_channel_list(struct dpp_authentication *auth, 2000 struct hostapd_hw_modes *own_modes, 2001 u16 num_modes) 2002 { 2003 int res; 2004 char freqs[DPP_BOOTSTRAP_MAX_FREQ * 6 + 10], *pos, *end; 2005 unsigned int i; 2006 2007 if (auth->peer_bi->num_freq > 0) 2008 res = dpp_channel_intersect(auth, own_modes, num_modes); 2009 else 2010 res = dpp_channel_local_list(auth, own_modes, num_modes); 2011 if (res < 0) 2012 return res; 2013 2014 /* Prioritize 2.4 GHz channels 6, 1, 11 (in this order) to hit the most 2015 * likely channels first. */ 2016 freq_to_start(auth->freq, auth->num_freq, 2462); 2017 freq_to_start(auth->freq, auth->num_freq, 2412); 2018 freq_to_start(auth->freq, auth->num_freq, 2437); 2019 2020 auth->freq_idx = 0; 2021 auth->curr_freq = auth->freq[0]; 2022 2023 pos = freqs; 2024 end = pos + sizeof(freqs); 2025 for (i = 0; i < auth->num_freq; i++) { 2026 res = os_snprintf(pos, end - pos, " %u", auth->freq[i]); 2027 if (os_snprintf_error(end - pos, res)) 2028 break; 2029 pos += res; 2030 } 2031 *pos = '\0'; 2032 wpa_printf(MSG_DEBUG, "DPP: Possible frequencies for initiating:%s", 2033 freqs); 2034 2035 return 0; 2036 } 2037 2038 2039 static int dpp_autogen_bootstrap_key(struct dpp_authentication *auth) 2040 { 2041 struct dpp_bootstrap_info *bi; 2042 char *pk = NULL; 2043 size_t len; 2044 2045 if (auth->own_bi) 2046 return 0; /* already generated */ 2047 2048 bi = os_zalloc(sizeof(*bi)); 2049 if (!bi) 2050 return -1; 2051 bi->type = DPP_BOOTSTRAP_QR_CODE; 2052 pk = dpp_keygen(bi, auth->peer_bi->curve->name, NULL, 0); 2053 if (!pk) 2054 goto fail; 2055 2056 len = 4; /* "DPP:" */ 2057 len += 4 + os_strlen(pk); 2058 bi->uri = os_malloc(len + 1); 2059 if (!bi->uri) 2060 goto fail; 2061 os_snprintf(bi->uri, len + 1, "DPP:K:%s;;", pk); 2062 wpa_printf(MSG_DEBUG, 2063 "DPP: Auto-generated own bootstrapping key info: URI %s", 2064 bi->uri); 2065 2066 auth->tmp_own_bi = auth->own_bi = bi; 2067 2068 os_free(pk); 2069 2070 return 0; 2071 fail: 2072 os_free(pk); 2073 dpp_bootstrap_info_free(bi); 2074 return -1; 2075 } 2076 2077 2078 struct dpp_authentication * dpp_auth_init(void *msg_ctx, 2079 struct dpp_bootstrap_info *peer_bi, 2080 struct dpp_bootstrap_info *own_bi, 2081 u8 dpp_allowed_roles, 2082 unsigned int neg_freq, 2083 struct hostapd_hw_modes *own_modes, 2084 u16 num_modes) 2085 { 2086 struct dpp_authentication *auth; 2087 size_t nonce_len; 2088 EVP_PKEY_CTX *ctx = NULL; 2089 size_t secret_len; 2090 struct wpabuf *pi = NULL; 2091 const u8 *r_pubkey_hash, *i_pubkey_hash; 2092 #ifdef CONFIG_TESTING_OPTIONS 2093 u8 test_hash[SHA256_MAC_LEN]; 2094 #endif /* CONFIG_TESTING_OPTIONS */ 2095 2096 auth = os_zalloc(sizeof(*auth)); 2097 if (!auth) 2098 return NULL; 2099 auth->msg_ctx = msg_ctx; 2100 auth->initiator = 1; 2101 auth->waiting_auth_resp = 1; 2102 auth->allowed_roles = dpp_allowed_roles; 2103 auth->configurator = !!(dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR); 2104 auth->peer_bi = peer_bi; 2105 auth->own_bi = own_bi; 2106 auth->curve = peer_bi->curve; 2107 2108 if (dpp_autogen_bootstrap_key(auth) < 0 || 2109 dpp_prepare_channel_list(auth, own_modes, num_modes) < 0) 2110 goto fail; 2111 2112 #ifdef CONFIG_TESTING_OPTIONS 2113 if (dpp_nonce_override_len > 0) { 2114 wpa_printf(MSG_INFO, "DPP: TESTING - override I-nonce"); 2115 nonce_len = dpp_nonce_override_len; 2116 os_memcpy(auth->i_nonce, dpp_nonce_override, nonce_len); 2117 } else { 2118 nonce_len = auth->curve->nonce_len; 2119 if (random_get_bytes(auth->i_nonce, nonce_len)) { 2120 wpa_printf(MSG_ERROR, 2121 "DPP: Failed to generate I-nonce"); 2122 goto fail; 2123 } 2124 } 2125 #else /* CONFIG_TESTING_OPTIONS */ 2126 nonce_len = auth->curve->nonce_len; 2127 if (random_get_bytes(auth->i_nonce, nonce_len)) { 2128 wpa_printf(MSG_ERROR, "DPP: Failed to generate I-nonce"); 2129 goto fail; 2130 } 2131 #endif /* CONFIG_TESTING_OPTIONS */ 2132 wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", auth->i_nonce, nonce_len); 2133 2134 #ifdef CONFIG_TESTING_OPTIONS 2135 if (dpp_protocol_key_override_len) { 2136 const struct dpp_curve_params *tmp_curve; 2137 2138 wpa_printf(MSG_INFO, 2139 "DPP: TESTING - override protocol key"); 2140 auth->own_protocol_key = dpp_set_keypair( 2141 &tmp_curve, dpp_protocol_key_override, 2142 dpp_protocol_key_override_len); 2143 } else { 2144 auth->own_protocol_key = dpp_gen_keypair(auth->curve); 2145 } 2146 #else /* CONFIG_TESTING_OPTIONS */ 2147 auth->own_protocol_key = dpp_gen_keypair(auth->curve); 2148 #endif /* CONFIG_TESTING_OPTIONS */ 2149 if (!auth->own_protocol_key) 2150 goto fail; 2151 2152 pi = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2153 if (!pi) 2154 goto fail; 2155 2156 /* ECDH: M = pI * BR */ 2157 ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); 2158 if (!ctx || 2159 EVP_PKEY_derive_init(ctx) != 1 || 2160 EVP_PKEY_derive_set_peer(ctx, auth->peer_bi->pubkey) != 1 || 2161 EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || 2162 secret_len > DPP_MAX_SHARED_SECRET_LEN || 2163 EVP_PKEY_derive(ctx, auth->Mx, &secret_len) != 1) { 2164 wpa_printf(MSG_ERROR, 2165 "DPP: Failed to derive ECDH shared secret: %s", 2166 ERR_error_string(ERR_get_error(), NULL)); 2167 goto fail; 2168 } 2169 auth->secret_len = secret_len; 2170 EVP_PKEY_CTX_free(ctx); 2171 ctx = NULL; 2172 2173 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (M.x)", 2174 auth->Mx, auth->secret_len); 2175 auth->Mx_len = auth->secret_len; 2176 2177 if (dpp_derive_k1(auth->Mx, auth->secret_len, auth->k1, 2178 auth->curve->hash_len) < 0) 2179 goto fail; 2180 2181 r_pubkey_hash = auth->peer_bi->pubkey_hash; 2182 i_pubkey_hash = auth->own_bi->pubkey_hash; 2183 2184 #ifdef CONFIG_TESTING_OPTIONS 2185 if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_REQ) { 2186 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); 2187 r_pubkey_hash = NULL; 2188 } else if (dpp_test == DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_REQ) { 2189 wpa_printf(MSG_INFO, 2190 "DPP: TESTING - invalid R-Bootstrap Key Hash"); 2191 os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); 2192 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2193 r_pubkey_hash = test_hash; 2194 } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_REQ) { 2195 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); 2196 i_pubkey_hash = NULL; 2197 } else if (dpp_test == DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_REQ) { 2198 wpa_printf(MSG_INFO, 2199 "DPP: TESTING - invalid I-Bootstrap Key Hash"); 2200 os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); 2201 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2202 i_pubkey_hash = test_hash; 2203 } else if (dpp_test == DPP_TEST_NO_I_PROTO_KEY_AUTH_REQ) { 2204 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Proto Key"); 2205 wpabuf_free(pi); 2206 pi = NULL; 2207 } else if (dpp_test == DPP_TEST_INVALID_I_PROTO_KEY_AUTH_REQ) { 2208 wpa_printf(MSG_INFO, "DPP: TESTING - invalid I-Proto Key"); 2209 wpabuf_free(pi); 2210 pi = wpabuf_alloc(2 * auth->curve->prime_len); 2211 if (!pi || dpp_test_gen_invalid_key(pi, auth->curve) < 0) 2212 goto fail; 2213 } 2214 #endif /* CONFIG_TESTING_OPTIONS */ 2215 2216 auth->req_msg = dpp_auth_build_req(auth, pi, nonce_len, r_pubkey_hash, 2217 i_pubkey_hash, neg_freq); 2218 if (!auth->req_msg) 2219 goto fail; 2220 2221 out: 2222 wpabuf_free(pi); 2223 EVP_PKEY_CTX_free(ctx); 2224 return auth; 2225 fail: 2226 dpp_auth_deinit(auth); 2227 auth = NULL; 2228 goto out; 2229 } 2230 2231 2232 static struct wpabuf * dpp_build_conf_req_attr(struct dpp_authentication *auth, 2233 const char *json) 2234 { 2235 size_t nonce_len; 2236 size_t json_len, clear_len; 2237 struct wpabuf *clear = NULL, *msg = NULL; 2238 u8 *wrapped; 2239 size_t attr_len; 2240 2241 wpa_printf(MSG_DEBUG, "DPP: Build configuration request"); 2242 2243 nonce_len = auth->curve->nonce_len; 2244 if (random_get_bytes(auth->e_nonce, nonce_len)) { 2245 wpa_printf(MSG_ERROR, "DPP: Failed to generate E-nonce"); 2246 goto fail; 2247 } 2248 wpa_hexdump(MSG_DEBUG, "DPP: E-nonce", auth->e_nonce, nonce_len); 2249 json_len = os_strlen(json); 2250 wpa_hexdump_ascii(MSG_DEBUG, "DPP: configAttr JSON", json, json_len); 2251 2252 /* { E-nonce, configAttrib }ke */ 2253 clear_len = 4 + nonce_len + 4 + json_len; 2254 clear = wpabuf_alloc(clear_len); 2255 attr_len = 4 + clear_len + AES_BLOCK_SIZE; 2256 #ifdef CONFIG_TESTING_OPTIONS 2257 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ) 2258 attr_len += 5; 2259 #endif /* CONFIG_TESTING_OPTIONS */ 2260 msg = wpabuf_alloc(attr_len); 2261 if (!clear || !msg) 2262 goto fail; 2263 2264 #ifdef CONFIG_TESTING_OPTIONS 2265 if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_REQ) { 2266 wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce"); 2267 goto skip_e_nonce; 2268 } 2269 if (dpp_test == DPP_TEST_INVALID_E_NONCE_CONF_REQ) { 2270 wpa_printf(MSG_INFO, "DPP: TESTING - invalid E-nonce"); 2271 wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); 2272 wpabuf_put_le16(clear, nonce_len - 1); 2273 wpabuf_put_data(clear, auth->e_nonce, nonce_len - 1); 2274 goto skip_e_nonce; 2275 } 2276 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_REQ) { 2277 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 2278 goto skip_wrapped_data; 2279 } 2280 #endif /* CONFIG_TESTING_OPTIONS */ 2281 2282 /* E-nonce */ 2283 wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); 2284 wpabuf_put_le16(clear, nonce_len); 2285 wpabuf_put_data(clear, auth->e_nonce, nonce_len); 2286 2287 #ifdef CONFIG_TESTING_OPTIONS 2288 skip_e_nonce: 2289 if (dpp_test == DPP_TEST_NO_CONFIG_ATTR_OBJ_CONF_REQ) { 2290 wpa_printf(MSG_INFO, "DPP: TESTING - no configAttrib"); 2291 goto skip_conf_attr_obj; 2292 } 2293 #endif /* CONFIG_TESTING_OPTIONS */ 2294 2295 /* configAttrib */ 2296 wpabuf_put_le16(clear, DPP_ATTR_CONFIG_ATTR_OBJ); 2297 wpabuf_put_le16(clear, json_len); 2298 wpabuf_put_data(clear, json, json_len); 2299 2300 #ifdef CONFIG_TESTING_OPTIONS 2301 skip_conf_attr_obj: 2302 #endif /* CONFIG_TESTING_OPTIONS */ 2303 2304 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 2305 wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 2306 wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 2307 2308 /* No AES-SIV AD */ 2309 wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); 2310 if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, 2311 wpabuf_head(clear), wpabuf_len(clear), 2312 0, NULL, NULL, wrapped) < 0) 2313 goto fail; 2314 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 2315 wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); 2316 2317 #ifdef CONFIG_TESTING_OPTIONS 2318 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_REQ) { 2319 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 2320 dpp_build_attr_status(msg, DPP_STATUS_OK); 2321 } 2322 skip_wrapped_data: 2323 #endif /* CONFIG_TESTING_OPTIONS */ 2324 2325 wpa_hexdump_buf(MSG_DEBUG, 2326 "DPP: Configuration Request frame attributes", msg); 2327 wpabuf_free(clear); 2328 return msg; 2329 2330 fail: 2331 wpabuf_free(clear); 2332 wpabuf_free(msg); 2333 return NULL; 2334 } 2335 2336 2337 static void dpp_write_adv_proto(struct wpabuf *buf) 2338 { 2339 /* Advertisement Protocol IE */ 2340 wpabuf_put_u8(buf, WLAN_EID_ADV_PROTO); 2341 wpabuf_put_u8(buf, 8); /* Length */ 2342 wpabuf_put_u8(buf, 0x7f); 2343 wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); 2344 wpabuf_put_u8(buf, 5); 2345 wpabuf_put_be24(buf, OUI_WFA); 2346 wpabuf_put_u8(buf, DPP_OUI_TYPE); 2347 wpabuf_put_u8(buf, 0x01); 2348 } 2349 2350 2351 static void dpp_write_gas_query(struct wpabuf *buf, struct wpabuf *query) 2352 { 2353 /* GAS Query */ 2354 wpabuf_put_le16(buf, wpabuf_len(query)); 2355 wpabuf_put_buf(buf, query); 2356 } 2357 2358 2359 struct wpabuf * dpp_build_conf_req(struct dpp_authentication *auth, 2360 const char *json) 2361 { 2362 struct wpabuf *buf, *conf_req; 2363 2364 conf_req = dpp_build_conf_req_attr(auth, json); 2365 if (!conf_req) { 2366 wpa_printf(MSG_DEBUG, 2367 "DPP: No configuration request data available"); 2368 return NULL; 2369 } 2370 2371 buf = gas_build_initial_req(0, 10 + 2 + wpabuf_len(conf_req)); 2372 if (!buf) { 2373 wpabuf_free(conf_req); 2374 return NULL; 2375 } 2376 2377 dpp_write_adv_proto(buf); 2378 dpp_write_gas_query(buf, conf_req); 2379 wpabuf_free(conf_req); 2380 wpa_hexdump_buf(MSG_MSGDUMP, "DPP: GAS Config Request", buf); 2381 2382 return buf; 2383 } 2384 2385 2386 static void dpp_auth_success(struct dpp_authentication *auth) 2387 { 2388 wpa_printf(MSG_DEBUG, 2389 "DPP: Authentication success - clear temporary keys"); 2390 os_memset(auth->Mx, 0, sizeof(auth->Mx)); 2391 auth->Mx_len = 0; 2392 os_memset(auth->Nx, 0, sizeof(auth->Nx)); 2393 auth->Nx_len = 0; 2394 os_memset(auth->Lx, 0, sizeof(auth->Lx)); 2395 auth->Lx_len = 0; 2396 os_memset(auth->k1, 0, sizeof(auth->k1)); 2397 os_memset(auth->k2, 0, sizeof(auth->k2)); 2398 2399 auth->auth_success = 1; 2400 } 2401 2402 2403 static int dpp_gen_r_auth(struct dpp_authentication *auth, u8 *r_auth) 2404 { 2405 struct wpabuf *pix, *prx, *bix, *brx; 2406 const u8 *addr[7]; 2407 size_t len[7]; 2408 size_t i, num_elem = 0; 2409 size_t nonce_len; 2410 u8 zero = 0; 2411 int res = -1; 2412 2413 /* R-auth = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ 2414 nonce_len = auth->curve->nonce_len; 2415 2416 if (auth->initiator) { 2417 pix = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2418 prx = dpp_get_pubkey_point(auth->peer_protocol_key, 0); 2419 if (auth->own_bi) 2420 bix = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); 2421 else 2422 bix = NULL; 2423 brx = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); 2424 } else { 2425 pix = dpp_get_pubkey_point(auth->peer_protocol_key, 0); 2426 prx = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2427 if (auth->peer_bi) 2428 bix = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); 2429 else 2430 bix = NULL; 2431 brx = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); 2432 } 2433 if (!pix || !prx || !brx) 2434 goto fail; 2435 2436 addr[num_elem] = auth->i_nonce; 2437 len[num_elem] = nonce_len; 2438 num_elem++; 2439 2440 addr[num_elem] = auth->r_nonce; 2441 len[num_elem] = nonce_len; 2442 num_elem++; 2443 2444 addr[num_elem] = wpabuf_head(pix); 2445 len[num_elem] = wpabuf_len(pix) / 2; 2446 num_elem++; 2447 2448 addr[num_elem] = wpabuf_head(prx); 2449 len[num_elem] = wpabuf_len(prx) / 2; 2450 num_elem++; 2451 2452 if (bix) { 2453 addr[num_elem] = wpabuf_head(bix); 2454 len[num_elem] = wpabuf_len(bix) / 2; 2455 num_elem++; 2456 } 2457 2458 addr[num_elem] = wpabuf_head(brx); 2459 len[num_elem] = wpabuf_len(brx) / 2; 2460 num_elem++; 2461 2462 addr[num_elem] = &zero; 2463 len[num_elem] = 1; 2464 num_elem++; 2465 2466 wpa_printf(MSG_DEBUG, "DPP: R-auth hash components"); 2467 for (i = 0; i < num_elem; i++) 2468 wpa_hexdump(MSG_DEBUG, "DPP: hash component", addr[i], len[i]); 2469 res = dpp_hash_vector(auth->curve, num_elem, addr, len, r_auth); 2470 if (res == 0) 2471 wpa_hexdump(MSG_DEBUG, "DPP: R-auth", r_auth, 2472 auth->curve->hash_len); 2473 fail: 2474 wpabuf_free(pix); 2475 wpabuf_free(prx); 2476 wpabuf_free(bix); 2477 wpabuf_free(brx); 2478 return res; 2479 } 2480 2481 2482 static int dpp_gen_i_auth(struct dpp_authentication *auth, u8 *i_auth) 2483 { 2484 struct wpabuf *pix = NULL, *prx = NULL, *bix = NULL, *brx = NULL; 2485 const u8 *addr[7]; 2486 size_t len[7]; 2487 size_t i, num_elem = 0; 2488 size_t nonce_len; 2489 u8 one = 1; 2490 int res = -1; 2491 2492 /* I-auth = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] 1) */ 2493 nonce_len = auth->curve->nonce_len; 2494 2495 if (auth->initiator) { 2496 pix = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2497 prx = dpp_get_pubkey_point(auth->peer_protocol_key, 0); 2498 if (auth->own_bi) 2499 bix = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); 2500 else 2501 bix = NULL; 2502 if (!auth->peer_bi) 2503 goto fail; 2504 brx = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); 2505 } else { 2506 pix = dpp_get_pubkey_point(auth->peer_protocol_key, 0); 2507 prx = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2508 if (auth->peer_bi) 2509 bix = dpp_get_pubkey_point(auth->peer_bi->pubkey, 0); 2510 else 2511 bix = NULL; 2512 if (!auth->own_bi) 2513 goto fail; 2514 brx = dpp_get_pubkey_point(auth->own_bi->pubkey, 0); 2515 } 2516 if (!pix || !prx || !brx) 2517 goto fail; 2518 2519 addr[num_elem] = auth->r_nonce; 2520 len[num_elem] = nonce_len; 2521 num_elem++; 2522 2523 addr[num_elem] = auth->i_nonce; 2524 len[num_elem] = nonce_len; 2525 num_elem++; 2526 2527 addr[num_elem] = wpabuf_head(prx); 2528 len[num_elem] = wpabuf_len(prx) / 2; 2529 num_elem++; 2530 2531 addr[num_elem] = wpabuf_head(pix); 2532 len[num_elem] = wpabuf_len(pix) / 2; 2533 num_elem++; 2534 2535 addr[num_elem] = wpabuf_head(brx); 2536 len[num_elem] = wpabuf_len(brx) / 2; 2537 num_elem++; 2538 2539 if (bix) { 2540 addr[num_elem] = wpabuf_head(bix); 2541 len[num_elem] = wpabuf_len(bix) / 2; 2542 num_elem++; 2543 } 2544 2545 addr[num_elem] = &one; 2546 len[num_elem] = 1; 2547 num_elem++; 2548 2549 wpa_printf(MSG_DEBUG, "DPP: I-auth hash components"); 2550 for (i = 0; i < num_elem; i++) 2551 wpa_hexdump(MSG_DEBUG, "DPP: hash component", addr[i], len[i]); 2552 res = dpp_hash_vector(auth->curve, num_elem, addr, len, i_auth); 2553 if (res == 0) 2554 wpa_hexdump(MSG_DEBUG, "DPP: I-auth", i_auth, 2555 auth->curve->hash_len); 2556 fail: 2557 wpabuf_free(pix); 2558 wpabuf_free(prx); 2559 wpabuf_free(bix); 2560 wpabuf_free(brx); 2561 return res; 2562 } 2563 2564 2565 static int dpp_auth_derive_l_responder(struct dpp_authentication *auth) 2566 { 2567 const EC_GROUP *group; 2568 EC_POINT *l = NULL; 2569 EC_KEY *BI = NULL, *bR = NULL, *pR = NULL; 2570 const EC_POINT *BI_point; 2571 BN_CTX *bnctx; 2572 BIGNUM *lx, *sum, *q; 2573 const BIGNUM *bR_bn, *pR_bn; 2574 int ret = -1; 2575 2576 /* L = ((bR + pR) modulo q) * BI */ 2577 2578 bnctx = BN_CTX_new(); 2579 sum = BN_new(); 2580 q = BN_new(); 2581 lx = BN_new(); 2582 if (!bnctx || !sum || !q || !lx) 2583 goto fail; 2584 BI = EVP_PKEY_get1_EC_KEY(auth->peer_bi->pubkey); 2585 if (!BI) 2586 goto fail; 2587 BI_point = EC_KEY_get0_public_key(BI); 2588 group = EC_KEY_get0_group(BI); 2589 if (!group) 2590 goto fail; 2591 2592 bR = EVP_PKEY_get1_EC_KEY(auth->own_bi->pubkey); 2593 pR = EVP_PKEY_get1_EC_KEY(auth->own_protocol_key); 2594 if (!bR || !pR) 2595 goto fail; 2596 bR_bn = EC_KEY_get0_private_key(bR); 2597 pR_bn = EC_KEY_get0_private_key(pR); 2598 if (!bR_bn || !pR_bn) 2599 goto fail; 2600 if (EC_GROUP_get_order(group, q, bnctx) != 1 || 2601 BN_mod_add(sum, bR_bn, pR_bn, q, bnctx) != 1) 2602 goto fail; 2603 l = EC_POINT_new(group); 2604 if (!l || 2605 EC_POINT_mul(group, l, NULL, BI_point, sum, bnctx) != 1 || 2606 EC_POINT_get_affine_coordinates_GFp(group, l, lx, NULL, 2607 bnctx) != 1) { 2608 wpa_printf(MSG_ERROR, 2609 "OpenSSL: failed: %s", 2610 ERR_error_string(ERR_get_error(), NULL)); 2611 goto fail; 2612 } 2613 2614 if (dpp_bn2bin_pad(lx, auth->Lx, auth->secret_len) < 0) 2615 goto fail; 2616 wpa_hexdump_key(MSG_DEBUG, "DPP: L.x", auth->Lx, auth->secret_len); 2617 auth->Lx_len = auth->secret_len; 2618 ret = 0; 2619 fail: 2620 EC_POINT_clear_free(l); 2621 EC_KEY_free(BI); 2622 EC_KEY_free(bR); 2623 EC_KEY_free(pR); 2624 BN_clear_free(lx); 2625 BN_clear_free(sum); 2626 BN_free(q); 2627 BN_CTX_free(bnctx); 2628 return ret; 2629 } 2630 2631 2632 static int dpp_auth_derive_l_initiator(struct dpp_authentication *auth) 2633 { 2634 const EC_GROUP *group; 2635 EC_POINT *l = NULL, *sum = NULL; 2636 EC_KEY *bI = NULL, *BR = NULL, *PR = NULL; 2637 const EC_POINT *BR_point, *PR_point; 2638 BN_CTX *bnctx; 2639 BIGNUM *lx; 2640 const BIGNUM *bI_bn; 2641 int ret = -1; 2642 2643 /* L = bI * (BR + PR) */ 2644 2645 bnctx = BN_CTX_new(); 2646 lx = BN_new(); 2647 if (!bnctx || !lx) 2648 goto fail; 2649 BR = EVP_PKEY_get1_EC_KEY(auth->peer_bi->pubkey); 2650 PR = EVP_PKEY_get1_EC_KEY(auth->peer_protocol_key); 2651 if (!BR || !PR) 2652 goto fail; 2653 BR_point = EC_KEY_get0_public_key(BR); 2654 PR_point = EC_KEY_get0_public_key(PR); 2655 2656 bI = EVP_PKEY_get1_EC_KEY(auth->own_bi->pubkey); 2657 if (!bI) 2658 goto fail; 2659 group = EC_KEY_get0_group(bI); 2660 bI_bn = EC_KEY_get0_private_key(bI); 2661 if (!group || !bI_bn) 2662 goto fail; 2663 sum = EC_POINT_new(group); 2664 l = EC_POINT_new(group); 2665 if (!sum || !l || 2666 EC_POINT_add(group, sum, BR_point, PR_point, bnctx) != 1 || 2667 EC_POINT_mul(group, l, NULL, sum, bI_bn, bnctx) != 1 || 2668 EC_POINT_get_affine_coordinates_GFp(group, l, lx, NULL, 2669 bnctx) != 1) { 2670 wpa_printf(MSG_ERROR, 2671 "OpenSSL: failed: %s", 2672 ERR_error_string(ERR_get_error(), NULL)); 2673 goto fail; 2674 } 2675 2676 if (dpp_bn2bin_pad(lx, auth->Lx, auth->secret_len) < 0) 2677 goto fail; 2678 wpa_hexdump_key(MSG_DEBUG, "DPP: L.x", auth->Lx, auth->secret_len); 2679 auth->Lx_len = auth->secret_len; 2680 ret = 0; 2681 fail: 2682 EC_POINT_clear_free(l); 2683 EC_POINT_clear_free(sum); 2684 EC_KEY_free(bI); 2685 EC_KEY_free(BR); 2686 EC_KEY_free(PR); 2687 BN_clear_free(lx); 2688 BN_CTX_free(bnctx); 2689 return ret; 2690 } 2691 2692 2693 static int dpp_auth_build_resp_ok(struct dpp_authentication *auth) 2694 { 2695 size_t nonce_len; 2696 EVP_PKEY_CTX *ctx = NULL; 2697 size_t secret_len; 2698 struct wpabuf *msg, *pr = NULL; 2699 u8 r_auth[4 + DPP_MAX_HASH_LEN]; 2700 u8 wrapped_r_auth[4 + DPP_MAX_HASH_LEN + AES_BLOCK_SIZE], *w_r_auth; 2701 size_t wrapped_r_auth_len; 2702 int ret = -1; 2703 const u8 *r_pubkey_hash, *i_pubkey_hash, *r_nonce, *i_nonce; 2704 enum dpp_status_error status = DPP_STATUS_OK; 2705 #ifdef CONFIG_TESTING_OPTIONS 2706 u8 test_hash[SHA256_MAC_LEN]; 2707 #endif /* CONFIG_TESTING_OPTIONS */ 2708 2709 wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response"); 2710 if (!auth->own_bi) 2711 return -1; 2712 2713 #ifdef CONFIG_TESTING_OPTIONS 2714 if (dpp_nonce_override_len > 0) { 2715 wpa_printf(MSG_INFO, "DPP: TESTING - override R-nonce"); 2716 nonce_len = dpp_nonce_override_len; 2717 os_memcpy(auth->r_nonce, dpp_nonce_override, nonce_len); 2718 } else { 2719 nonce_len = auth->curve->nonce_len; 2720 if (random_get_bytes(auth->r_nonce, nonce_len)) { 2721 wpa_printf(MSG_ERROR, 2722 "DPP: Failed to generate R-nonce"); 2723 goto fail; 2724 } 2725 } 2726 #else /* CONFIG_TESTING_OPTIONS */ 2727 nonce_len = auth->curve->nonce_len; 2728 if (random_get_bytes(auth->r_nonce, nonce_len)) { 2729 wpa_printf(MSG_ERROR, "DPP: Failed to generate R-nonce"); 2730 goto fail; 2731 } 2732 #endif /* CONFIG_TESTING_OPTIONS */ 2733 wpa_hexdump(MSG_DEBUG, "DPP: R-nonce", auth->r_nonce, nonce_len); 2734 2735 #ifdef CONFIG_TESTING_OPTIONS 2736 if (dpp_protocol_key_override_len) { 2737 const struct dpp_curve_params *tmp_curve; 2738 2739 wpa_printf(MSG_INFO, 2740 "DPP: TESTING - override protocol key"); 2741 auth->own_protocol_key = dpp_set_keypair( 2742 &tmp_curve, dpp_protocol_key_override, 2743 dpp_protocol_key_override_len); 2744 } else { 2745 auth->own_protocol_key = dpp_gen_keypair(auth->curve); 2746 } 2747 #else /* CONFIG_TESTING_OPTIONS */ 2748 auth->own_protocol_key = dpp_gen_keypair(auth->curve); 2749 #endif /* CONFIG_TESTING_OPTIONS */ 2750 if (!auth->own_protocol_key) 2751 goto fail; 2752 2753 pr = dpp_get_pubkey_point(auth->own_protocol_key, 0); 2754 if (!pr) 2755 goto fail; 2756 2757 /* ECDH: N = pR * PI */ 2758 ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); 2759 if (!ctx || 2760 EVP_PKEY_derive_init(ctx) != 1 || 2761 EVP_PKEY_derive_set_peer(ctx, auth->peer_protocol_key) != 1 || 2762 EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || 2763 secret_len > DPP_MAX_SHARED_SECRET_LEN || 2764 EVP_PKEY_derive(ctx, auth->Nx, &secret_len) != 1) { 2765 wpa_printf(MSG_ERROR, 2766 "DPP: Failed to derive ECDH shared secret: %s", 2767 ERR_error_string(ERR_get_error(), NULL)); 2768 goto fail; 2769 } 2770 EVP_PKEY_CTX_free(ctx); 2771 ctx = NULL; 2772 2773 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)", 2774 auth->Nx, auth->secret_len); 2775 auth->Nx_len = auth->secret_len; 2776 2777 if (dpp_derive_k2(auth->Nx, auth->secret_len, auth->k2, 2778 auth->curve->hash_len) < 0) 2779 goto fail; 2780 2781 if (auth->own_bi && auth->peer_bi) { 2782 /* Mutual authentication */ 2783 if (dpp_auth_derive_l_responder(auth) < 0) 2784 goto fail; 2785 } 2786 2787 if (dpp_derive_ke(auth, auth->ke, auth->curve->hash_len) < 0) 2788 goto fail; 2789 2790 /* R-auth = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ 2791 WPA_PUT_LE16(r_auth, DPP_ATTR_R_AUTH_TAG); 2792 WPA_PUT_LE16(&r_auth[2], auth->curve->hash_len); 2793 if (dpp_gen_r_auth(auth, r_auth + 4) < 0) 2794 goto fail; 2795 #ifdef CONFIG_TESTING_OPTIONS 2796 if (dpp_test == DPP_TEST_R_AUTH_MISMATCH_AUTH_RESP) { 2797 wpa_printf(MSG_INFO, "DPP: TESTING - R-auth mismatch"); 2798 r_auth[4 + auth->curve->hash_len / 2] ^= 0x01; 2799 } 2800 #endif /* CONFIG_TESTING_OPTIONS */ 2801 if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, 2802 r_auth, 4 + auth->curve->hash_len, 2803 0, NULL, NULL, wrapped_r_auth) < 0) 2804 goto fail; 2805 wrapped_r_auth_len = 4 + auth->curve->hash_len + AES_BLOCK_SIZE; 2806 wpa_hexdump(MSG_DEBUG, "DPP: {R-auth}ke", 2807 wrapped_r_auth, wrapped_r_auth_len); 2808 w_r_auth = wrapped_r_auth; 2809 2810 r_pubkey_hash = auth->own_bi->pubkey_hash; 2811 if (auth->peer_bi) 2812 i_pubkey_hash = auth->peer_bi->pubkey_hash; 2813 else 2814 i_pubkey_hash = NULL; 2815 2816 i_nonce = auth->i_nonce; 2817 r_nonce = auth->r_nonce; 2818 2819 #ifdef CONFIG_TESTING_OPTIONS 2820 if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2821 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); 2822 r_pubkey_hash = NULL; 2823 } else if (dpp_test == 2824 DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2825 wpa_printf(MSG_INFO, 2826 "DPP: TESTING - invalid R-Bootstrap Key Hash"); 2827 os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); 2828 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2829 r_pubkey_hash = test_hash; 2830 } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2831 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); 2832 i_pubkey_hash = NULL; 2833 } else if (dpp_test == 2834 DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2835 wpa_printf(MSG_INFO, 2836 "DPP: TESTING - invalid I-Bootstrap Key Hash"); 2837 if (i_pubkey_hash) 2838 os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); 2839 else 2840 os_memset(test_hash, 0, SHA256_MAC_LEN); 2841 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2842 i_pubkey_hash = test_hash; 2843 } else if (dpp_test == DPP_TEST_NO_R_PROTO_KEY_AUTH_RESP) { 2844 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Proto Key"); 2845 wpabuf_free(pr); 2846 pr = NULL; 2847 } else if (dpp_test == DPP_TEST_INVALID_R_PROTO_KEY_AUTH_RESP) { 2848 wpa_printf(MSG_INFO, "DPP: TESTING - invalid R-Proto Key"); 2849 wpabuf_free(pr); 2850 pr = wpabuf_alloc(2 * auth->curve->prime_len); 2851 if (!pr || dpp_test_gen_invalid_key(pr, auth->curve) < 0) 2852 goto fail; 2853 } else if (dpp_test == DPP_TEST_NO_R_AUTH_AUTH_RESP) { 2854 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Auth"); 2855 w_r_auth = NULL; 2856 wrapped_r_auth_len = 0; 2857 } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) { 2858 wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); 2859 status = 255; 2860 } else if (dpp_test == DPP_TEST_INVALID_STATUS_AUTH_RESP) { 2861 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); 2862 status = 254; 2863 } else if (dpp_test == DPP_TEST_NO_R_NONCE_AUTH_RESP) { 2864 wpa_printf(MSG_INFO, "DPP: TESTING - no R-nonce"); 2865 r_nonce = NULL; 2866 } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) { 2867 wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); 2868 i_nonce = NULL; 2869 } 2870 #endif /* CONFIG_TESTING_OPTIONS */ 2871 2872 msg = dpp_auth_build_resp(auth, status, pr, nonce_len, 2873 r_pubkey_hash, i_pubkey_hash, 2874 r_nonce, i_nonce, 2875 w_r_auth, wrapped_r_auth_len, 2876 auth->k2); 2877 if (!msg) 2878 goto fail; 2879 wpabuf_free(auth->resp_msg); 2880 auth->resp_msg = msg; 2881 ret = 0; 2882 fail: 2883 wpabuf_free(pr); 2884 return ret; 2885 } 2886 2887 2888 static int dpp_auth_build_resp_status(struct dpp_authentication *auth, 2889 enum dpp_status_error status) 2890 { 2891 struct wpabuf *msg; 2892 const u8 *r_pubkey_hash, *i_pubkey_hash, *i_nonce; 2893 #ifdef CONFIG_TESTING_OPTIONS 2894 u8 test_hash[SHA256_MAC_LEN]; 2895 #endif /* CONFIG_TESTING_OPTIONS */ 2896 2897 if (!auth->own_bi) 2898 return -1; 2899 wpa_printf(MSG_DEBUG, "DPP: Build Authentication Response"); 2900 2901 r_pubkey_hash = auth->own_bi->pubkey_hash; 2902 if (auth->peer_bi) 2903 i_pubkey_hash = auth->peer_bi->pubkey_hash; 2904 else 2905 i_pubkey_hash = NULL; 2906 2907 i_nonce = auth->i_nonce; 2908 2909 #ifdef CONFIG_TESTING_OPTIONS 2910 if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2911 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); 2912 r_pubkey_hash = NULL; 2913 } else if (dpp_test == 2914 DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2915 wpa_printf(MSG_INFO, 2916 "DPP: TESTING - invalid R-Bootstrap Key Hash"); 2917 os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); 2918 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2919 r_pubkey_hash = test_hash; 2920 } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2921 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); 2922 i_pubkey_hash = NULL; 2923 } else if (dpp_test == 2924 DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_RESP) { 2925 wpa_printf(MSG_INFO, 2926 "DPP: TESTING - invalid I-Bootstrap Key Hash"); 2927 if (i_pubkey_hash) 2928 os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); 2929 else 2930 os_memset(test_hash, 0, SHA256_MAC_LEN); 2931 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 2932 i_pubkey_hash = test_hash; 2933 } else if (dpp_test == DPP_TEST_NO_STATUS_AUTH_RESP) { 2934 wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); 2935 status = 255; 2936 } else if (dpp_test == DPP_TEST_NO_I_NONCE_AUTH_RESP) { 2937 wpa_printf(MSG_INFO, "DPP: TESTING - no I-nonce"); 2938 i_nonce = NULL; 2939 } 2940 #endif /* CONFIG_TESTING_OPTIONS */ 2941 2942 msg = dpp_auth_build_resp(auth, status, NULL, auth->curve->nonce_len, 2943 r_pubkey_hash, i_pubkey_hash, 2944 NULL, i_nonce, NULL, 0, auth->k1); 2945 if (!msg) 2946 return -1; 2947 wpabuf_free(auth->resp_msg); 2948 auth->resp_msg = msg; 2949 return 0; 2950 } 2951 2952 2953 struct dpp_authentication * 2954 dpp_auth_req_rx(void *msg_ctx, u8 dpp_allowed_roles, int qr_mutual, 2955 struct dpp_bootstrap_info *peer_bi, 2956 struct dpp_bootstrap_info *own_bi, 2957 unsigned int freq, const u8 *hdr, const u8 *attr_start, 2958 size_t attr_len) 2959 { 2960 EVP_PKEY *pi = NULL; 2961 EVP_PKEY_CTX *ctx = NULL; 2962 size_t secret_len; 2963 const u8 *addr[2]; 2964 size_t len[2]; 2965 u8 *unwrapped = NULL; 2966 size_t unwrapped_len = 0; 2967 const u8 *wrapped_data, *i_proto, *i_nonce, *i_capab, *i_bootstrap, 2968 *channel; 2969 u16 wrapped_data_len, i_proto_len, i_nonce_len, i_capab_len, 2970 i_bootstrap_len, channel_len; 2971 struct dpp_authentication *auth = NULL; 2972 #ifdef CONFIG_DPP2 2973 const u8 *version; 2974 u16 version_len; 2975 #endif /* CONFIG_DPP2 */ 2976 2977 #ifdef CONFIG_TESTING_OPTIONS 2978 if (dpp_test == DPP_TEST_STOP_AT_AUTH_REQ) { 2979 wpa_printf(MSG_INFO, 2980 "DPP: TESTING - stop at Authentication Request"); 2981 return NULL; 2982 } 2983 #endif /* CONFIG_TESTING_OPTIONS */ 2984 2985 wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, 2986 &wrapped_data_len); 2987 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 2988 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 2989 "Missing or invalid required Wrapped Data attribute"); 2990 return NULL; 2991 } 2992 wpa_hexdump(MSG_MSGDUMP, "DPP: Wrapped Data", 2993 wrapped_data, wrapped_data_len); 2994 attr_len = wrapped_data - 4 - attr_start; 2995 2996 auth = os_zalloc(sizeof(*auth)); 2997 if (!auth) 2998 goto fail; 2999 auth->msg_ctx = msg_ctx; 3000 auth->peer_bi = peer_bi; 3001 auth->own_bi = own_bi; 3002 auth->curve = own_bi->curve; 3003 auth->curr_freq = freq; 3004 3005 auth->peer_version = 1; /* default to the first version */ 3006 #ifdef CONFIG_DPP2 3007 version = dpp_get_attr(attr_start, attr_len, DPP_ATTR_PROTOCOL_VERSION, 3008 &version_len); 3009 if (version) { 3010 if (version_len < 1 || version[0] == 0) { 3011 dpp_auth_fail(auth, 3012 "Invalid Protocol Version attribute"); 3013 goto fail; 3014 } 3015 auth->peer_version = version[0]; 3016 wpa_printf(MSG_DEBUG, "DPP: Peer protocol version %u", 3017 auth->peer_version); 3018 } 3019 #endif /* CONFIG_DPP2 */ 3020 3021 channel = dpp_get_attr(attr_start, attr_len, DPP_ATTR_CHANNEL, 3022 &channel_len); 3023 if (channel) { 3024 int neg_freq; 3025 3026 if (channel_len < 2) { 3027 dpp_auth_fail(auth, "Too short Channel attribute"); 3028 goto fail; 3029 } 3030 3031 neg_freq = ieee80211_chan_to_freq(NULL, channel[0], channel[1]); 3032 wpa_printf(MSG_DEBUG, 3033 "DPP: Initiator requested different channel for negotiation: op_class=%u channel=%u --> freq=%d", 3034 channel[0], channel[1], neg_freq); 3035 if (neg_freq < 0) { 3036 dpp_auth_fail(auth, 3037 "Unsupported Channel attribute value"); 3038 goto fail; 3039 } 3040 3041 if (auth->curr_freq != (unsigned int) neg_freq) { 3042 wpa_printf(MSG_DEBUG, 3043 "DPP: Changing negotiation channel from %u MHz to %u MHz", 3044 freq, neg_freq); 3045 auth->curr_freq = neg_freq; 3046 } 3047 } 3048 3049 i_proto = dpp_get_attr(attr_start, attr_len, DPP_ATTR_I_PROTOCOL_KEY, 3050 &i_proto_len); 3051 if (!i_proto) { 3052 dpp_auth_fail(auth, 3053 "Missing required Initiator Protocol Key attribute"); 3054 goto fail; 3055 } 3056 wpa_hexdump(MSG_MSGDUMP, "DPP: Initiator Protocol Key", 3057 i_proto, i_proto_len); 3058 3059 /* M = bR * PI */ 3060 pi = dpp_set_pubkey_point(own_bi->pubkey, i_proto, i_proto_len); 3061 if (!pi) { 3062 dpp_auth_fail(auth, "Invalid Initiator Protocol Key"); 3063 goto fail; 3064 } 3065 dpp_debug_print_key("Peer (Initiator) Protocol Key", pi); 3066 3067 ctx = EVP_PKEY_CTX_new(own_bi->pubkey, NULL); 3068 if (!ctx || 3069 EVP_PKEY_derive_init(ctx) != 1 || 3070 EVP_PKEY_derive_set_peer(ctx, pi) != 1 || 3071 EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || 3072 secret_len > DPP_MAX_SHARED_SECRET_LEN || 3073 EVP_PKEY_derive(ctx, auth->Mx, &secret_len) != 1) { 3074 wpa_printf(MSG_ERROR, 3075 "DPP: Failed to derive ECDH shared secret: %s", 3076 ERR_error_string(ERR_get_error(), NULL)); 3077 dpp_auth_fail(auth, "Failed to derive ECDH shared secret"); 3078 goto fail; 3079 } 3080 auth->secret_len = secret_len; 3081 EVP_PKEY_CTX_free(ctx); 3082 ctx = NULL; 3083 3084 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (M.x)", 3085 auth->Mx, auth->secret_len); 3086 auth->Mx_len = auth->secret_len; 3087 3088 if (dpp_derive_k1(auth->Mx, auth->secret_len, auth->k1, 3089 auth->curve->hash_len) < 0) 3090 goto fail; 3091 3092 addr[0] = hdr; 3093 len[0] = DPP_HDR_LEN; 3094 addr[1] = attr_start; 3095 len[1] = attr_len; 3096 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 3097 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 3098 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 3099 wrapped_data, wrapped_data_len); 3100 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 3101 unwrapped = os_malloc(unwrapped_len); 3102 if (!unwrapped) 3103 goto fail; 3104 if (aes_siv_decrypt(auth->k1, auth->curve->hash_len, 3105 wrapped_data, wrapped_data_len, 3106 2, addr, len, unwrapped) < 0) { 3107 dpp_auth_fail(auth, "AES-SIV decryption failed"); 3108 goto fail; 3109 } 3110 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 3111 unwrapped, unwrapped_len); 3112 3113 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 3114 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 3115 goto fail; 3116 } 3117 3118 i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, 3119 &i_nonce_len); 3120 if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { 3121 dpp_auth_fail(auth, "Missing or invalid I-nonce"); 3122 goto fail; 3123 } 3124 wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); 3125 os_memcpy(auth->i_nonce, i_nonce, i_nonce_len); 3126 3127 i_capab = dpp_get_attr(unwrapped, unwrapped_len, 3128 DPP_ATTR_I_CAPABILITIES, 3129 &i_capab_len); 3130 if (!i_capab || i_capab_len < 1) { 3131 dpp_auth_fail(auth, "Missing or invalid I-capabilities"); 3132 goto fail; 3133 } 3134 auth->i_capab = i_capab[0]; 3135 wpa_printf(MSG_DEBUG, "DPP: I-capabilities: 0x%02x", auth->i_capab); 3136 3137 bin_clear_free(unwrapped, unwrapped_len); 3138 unwrapped = NULL; 3139 3140 switch (auth->i_capab & DPP_CAPAB_ROLE_MASK) { 3141 case DPP_CAPAB_ENROLLEE: 3142 if (!(dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR)) { 3143 wpa_printf(MSG_DEBUG, 3144 "DPP: Local policy does not allow Configurator role"); 3145 goto not_compatible; 3146 } 3147 wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator"); 3148 auth->configurator = 1; 3149 break; 3150 case DPP_CAPAB_CONFIGURATOR: 3151 if (!(dpp_allowed_roles & DPP_CAPAB_ENROLLEE)) { 3152 wpa_printf(MSG_DEBUG, 3153 "DPP: Local policy does not allow Enrollee role"); 3154 goto not_compatible; 3155 } 3156 wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee"); 3157 auth->configurator = 0; 3158 break; 3159 case DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE: 3160 if (dpp_allowed_roles & DPP_CAPAB_ENROLLEE) { 3161 wpa_printf(MSG_DEBUG, "DPP: Acting as Enrollee"); 3162 auth->configurator = 0; 3163 } else if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR) { 3164 wpa_printf(MSG_DEBUG, "DPP: Acting as Configurator"); 3165 auth->configurator = 1; 3166 } else { 3167 wpa_printf(MSG_DEBUG, 3168 "DPP: Local policy does not allow Configurator/Enrollee role"); 3169 goto not_compatible; 3170 } 3171 break; 3172 default: 3173 wpa_printf(MSG_DEBUG, "DPP: Unexpected role in I-capabilities"); 3174 wpa_msg(auth->msg_ctx, MSG_INFO, 3175 DPP_EVENT_FAIL "Invalid role in I-capabilities 0x%02x", 3176 auth->i_capab & DPP_CAPAB_ROLE_MASK); 3177 goto fail; 3178 } 3179 3180 auth->peer_protocol_key = pi; 3181 pi = NULL; 3182 if (qr_mutual && !peer_bi && own_bi->type == DPP_BOOTSTRAP_QR_CODE) { 3183 char hex[SHA256_MAC_LEN * 2 + 1]; 3184 3185 wpa_printf(MSG_DEBUG, 3186 "DPP: Mutual authentication required with QR Codes, but peer info is not yet available - request more time"); 3187 if (dpp_auth_build_resp_status(auth, 3188 DPP_STATUS_RESPONSE_PENDING) < 0) 3189 goto fail; 3190 i_bootstrap = dpp_get_attr(attr_start, attr_len, 3191 DPP_ATTR_I_BOOTSTRAP_KEY_HASH, 3192 &i_bootstrap_len); 3193 if (i_bootstrap && i_bootstrap_len == SHA256_MAC_LEN) { 3194 auth->response_pending = 1; 3195 os_memcpy(auth->waiting_pubkey_hash, 3196 i_bootstrap, i_bootstrap_len); 3197 wpa_snprintf_hex(hex, sizeof(hex), i_bootstrap, 3198 i_bootstrap_len); 3199 } else { 3200 hex[0] = '\0'; 3201 } 3202 3203 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_SCAN_PEER_QR_CODE 3204 "%s", hex); 3205 return auth; 3206 } 3207 if (dpp_auth_build_resp_ok(auth) < 0) 3208 goto fail; 3209 3210 return auth; 3211 3212 not_compatible: 3213 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_NOT_COMPATIBLE 3214 "i-capab=0x%02x", auth->i_capab); 3215 if (dpp_allowed_roles & DPP_CAPAB_CONFIGURATOR) 3216 auth->configurator = 1; 3217 else 3218 auth->configurator = 0; 3219 auth->peer_protocol_key = pi; 3220 pi = NULL; 3221 if (dpp_auth_build_resp_status(auth, DPP_STATUS_NOT_COMPATIBLE) < 0) 3222 goto fail; 3223 3224 auth->remove_on_tx_status = 1; 3225 return auth; 3226 fail: 3227 bin_clear_free(unwrapped, unwrapped_len); 3228 EVP_PKEY_free(pi); 3229 EVP_PKEY_CTX_free(ctx); 3230 dpp_auth_deinit(auth); 3231 return NULL; 3232 } 3233 3234 3235 int dpp_notify_new_qr_code(struct dpp_authentication *auth, 3236 struct dpp_bootstrap_info *peer_bi) 3237 { 3238 if (!auth || !auth->response_pending || 3239 os_memcmp(auth->waiting_pubkey_hash, peer_bi->pubkey_hash, 3240 SHA256_MAC_LEN) != 0) 3241 return 0; 3242 3243 wpa_printf(MSG_DEBUG, 3244 "DPP: New scanned QR Code has matching public key that was needed to continue DPP Authentication exchange with " 3245 MACSTR, MAC2STR(auth->peer_mac_addr)); 3246 auth->peer_bi = peer_bi; 3247 3248 if (dpp_auth_build_resp_ok(auth) < 0) 3249 return -1; 3250 3251 return 1; 3252 } 3253 3254 3255 static struct wpabuf * dpp_auth_build_conf(struct dpp_authentication *auth, 3256 enum dpp_status_error status) 3257 { 3258 struct wpabuf *msg; 3259 u8 i_auth[4 + DPP_MAX_HASH_LEN]; 3260 size_t i_auth_len; 3261 u8 r_nonce[4 + DPP_MAX_NONCE_LEN]; 3262 size_t r_nonce_len; 3263 const u8 *addr[2]; 3264 size_t len[2], attr_len; 3265 u8 *wrapped_i_auth; 3266 u8 *wrapped_r_nonce; 3267 u8 *attr_start, *attr_end; 3268 const u8 *r_pubkey_hash, *i_pubkey_hash; 3269 #ifdef CONFIG_TESTING_OPTIONS 3270 u8 test_hash[SHA256_MAC_LEN]; 3271 #endif /* CONFIG_TESTING_OPTIONS */ 3272 3273 wpa_printf(MSG_DEBUG, "DPP: Build Authentication Confirmation"); 3274 3275 i_auth_len = 4 + auth->curve->hash_len; 3276 r_nonce_len = 4 + auth->curve->nonce_len; 3277 /* Build DPP Authentication Confirmation frame attributes */ 3278 attr_len = 4 + 1 + 2 * (4 + SHA256_MAC_LEN) + 3279 4 + i_auth_len + r_nonce_len + AES_BLOCK_SIZE; 3280 #ifdef CONFIG_TESTING_OPTIONS 3281 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_CONF) 3282 attr_len += 5; 3283 #endif /* CONFIG_TESTING_OPTIONS */ 3284 msg = dpp_alloc_msg(DPP_PA_AUTHENTICATION_CONF, attr_len); 3285 if (!msg) 3286 goto fail; 3287 3288 attr_start = wpabuf_put(msg, 0); 3289 3290 r_pubkey_hash = auth->peer_bi->pubkey_hash; 3291 if (auth->own_bi) 3292 i_pubkey_hash = auth->own_bi->pubkey_hash; 3293 else 3294 i_pubkey_hash = NULL; 3295 3296 #ifdef CONFIG_TESTING_OPTIONS 3297 if (dpp_test == DPP_TEST_NO_STATUS_AUTH_CONF) { 3298 wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); 3299 goto skip_status; 3300 } else if (dpp_test == DPP_TEST_INVALID_STATUS_AUTH_CONF) { 3301 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); 3302 status = 254; 3303 } 3304 #endif /* CONFIG_TESTING_OPTIONS */ 3305 3306 /* DPP Status */ 3307 dpp_build_attr_status(msg, status); 3308 3309 #ifdef CONFIG_TESTING_OPTIONS 3310 skip_status: 3311 if (dpp_test == DPP_TEST_NO_R_BOOTSTRAP_KEY_HASH_AUTH_CONF) { 3312 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Bootstrap Key Hash"); 3313 r_pubkey_hash = NULL; 3314 } else if (dpp_test == 3315 DPP_TEST_INVALID_R_BOOTSTRAP_KEY_HASH_AUTH_CONF) { 3316 wpa_printf(MSG_INFO, 3317 "DPP: TESTING - invalid R-Bootstrap Key Hash"); 3318 os_memcpy(test_hash, r_pubkey_hash, SHA256_MAC_LEN); 3319 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 3320 r_pubkey_hash = test_hash; 3321 } else if (dpp_test == DPP_TEST_NO_I_BOOTSTRAP_KEY_HASH_AUTH_CONF) { 3322 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Bootstrap Key Hash"); 3323 i_pubkey_hash = NULL; 3324 } else if (dpp_test == 3325 DPP_TEST_INVALID_I_BOOTSTRAP_KEY_HASH_AUTH_CONF) { 3326 wpa_printf(MSG_INFO, 3327 "DPP: TESTING - invalid I-Bootstrap Key Hash"); 3328 if (i_pubkey_hash) 3329 os_memcpy(test_hash, i_pubkey_hash, SHA256_MAC_LEN); 3330 else 3331 os_memset(test_hash, 0, SHA256_MAC_LEN); 3332 test_hash[SHA256_MAC_LEN - 1] ^= 0x01; 3333 i_pubkey_hash = test_hash; 3334 } 3335 #endif /* CONFIG_TESTING_OPTIONS */ 3336 3337 /* Responder Bootstrapping Key Hash */ 3338 dpp_build_attr_r_bootstrap_key_hash(msg, r_pubkey_hash); 3339 3340 /* Initiator Bootstrapping Key Hash (mutual authentication) */ 3341 dpp_build_attr_i_bootstrap_key_hash(msg, i_pubkey_hash); 3342 3343 #ifdef CONFIG_TESTING_OPTIONS 3344 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_AUTH_CONF) 3345 goto skip_wrapped_data; 3346 if (dpp_test == DPP_TEST_NO_I_AUTH_AUTH_CONF) 3347 i_auth_len = 0; 3348 #endif /* CONFIG_TESTING_OPTIONS */ 3349 3350 attr_end = wpabuf_put(msg, 0); 3351 3352 /* OUI, OUI type, Crypto Suite, DPP frame type */ 3353 addr[0] = wpabuf_head_u8(msg) + 2; 3354 len[0] = 3 + 1 + 1 + 1; 3355 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 3356 3357 /* Attributes before Wrapped Data */ 3358 addr[1] = attr_start; 3359 len[1] = attr_end - attr_start; 3360 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 3361 3362 if (status == DPP_STATUS_OK) { 3363 /* I-auth wrapped with ke */ 3364 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 3365 wpabuf_put_le16(msg, i_auth_len + AES_BLOCK_SIZE); 3366 wrapped_i_auth = wpabuf_put(msg, i_auth_len + AES_BLOCK_SIZE); 3367 3368 #ifdef CONFIG_TESTING_OPTIONS 3369 if (dpp_test == DPP_TEST_NO_I_AUTH_AUTH_CONF) 3370 goto skip_i_auth; 3371 #endif /* CONFIG_TESTING_OPTIONS */ 3372 3373 /* I-auth = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] 3374 * 1) */ 3375 WPA_PUT_LE16(i_auth, DPP_ATTR_I_AUTH_TAG); 3376 WPA_PUT_LE16(&i_auth[2], auth->curve->hash_len); 3377 if (dpp_gen_i_auth(auth, i_auth + 4) < 0) 3378 goto fail; 3379 3380 #ifdef CONFIG_TESTING_OPTIONS 3381 if (dpp_test == DPP_TEST_I_AUTH_MISMATCH_AUTH_CONF) { 3382 wpa_printf(MSG_INFO, "DPP: TESTING - I-auth mismatch"); 3383 i_auth[4 + auth->curve->hash_len / 2] ^= 0x01; 3384 } 3385 skip_i_auth: 3386 #endif /* CONFIG_TESTING_OPTIONS */ 3387 if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, 3388 i_auth, i_auth_len, 3389 2, addr, len, wrapped_i_auth) < 0) 3390 goto fail; 3391 wpa_hexdump(MSG_DEBUG, "DPP: {I-auth}ke", 3392 wrapped_i_auth, i_auth_len + AES_BLOCK_SIZE); 3393 } else { 3394 /* R-nonce wrapped with k2 */ 3395 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 3396 wpabuf_put_le16(msg, r_nonce_len + AES_BLOCK_SIZE); 3397 wrapped_r_nonce = wpabuf_put(msg, r_nonce_len + AES_BLOCK_SIZE); 3398 3399 WPA_PUT_LE16(r_nonce, DPP_ATTR_R_NONCE); 3400 WPA_PUT_LE16(&r_nonce[2], auth->curve->nonce_len); 3401 os_memcpy(r_nonce + 4, auth->r_nonce, auth->curve->nonce_len); 3402 3403 if (aes_siv_encrypt(auth->k2, auth->curve->hash_len, 3404 r_nonce, r_nonce_len, 3405 2, addr, len, wrapped_r_nonce) < 0) 3406 goto fail; 3407 wpa_hexdump(MSG_DEBUG, "DPP: {R-nonce}k2", 3408 wrapped_r_nonce, r_nonce_len + AES_BLOCK_SIZE); 3409 } 3410 3411 #ifdef CONFIG_TESTING_OPTIONS 3412 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_AUTH_CONF) { 3413 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 3414 dpp_build_attr_status(msg, DPP_STATUS_OK); 3415 } 3416 skip_wrapped_data: 3417 #endif /* CONFIG_TESTING_OPTIONS */ 3418 3419 wpa_hexdump_buf(MSG_DEBUG, 3420 "DPP: Authentication Confirmation frame attributes", 3421 msg); 3422 if (status == DPP_STATUS_OK) 3423 dpp_auth_success(auth); 3424 3425 return msg; 3426 3427 fail: 3428 wpabuf_free(msg); 3429 return NULL; 3430 } 3431 3432 3433 static void 3434 dpp_auth_resp_rx_status(struct dpp_authentication *auth, const u8 *hdr, 3435 const u8 *attr_start, size_t attr_len, 3436 const u8 *wrapped_data, u16 wrapped_data_len, 3437 enum dpp_status_error status) 3438 { 3439 const u8 *addr[2]; 3440 size_t len[2]; 3441 u8 *unwrapped = NULL; 3442 size_t unwrapped_len = 0; 3443 const u8 *i_nonce, *r_capab; 3444 u16 i_nonce_len, r_capab_len; 3445 3446 if (status == DPP_STATUS_NOT_COMPATIBLE) { 3447 wpa_printf(MSG_DEBUG, 3448 "DPP: Responder reported incompatible roles"); 3449 } else if (status == DPP_STATUS_RESPONSE_PENDING) { 3450 wpa_printf(MSG_DEBUG, 3451 "DPP: Responder reported more time needed"); 3452 } else { 3453 wpa_printf(MSG_DEBUG, 3454 "DPP: Responder reported failure (status %d)", 3455 status); 3456 dpp_auth_fail(auth, "Responder reported failure"); 3457 return; 3458 } 3459 3460 addr[0] = hdr; 3461 len[0] = DPP_HDR_LEN; 3462 addr[1] = attr_start; 3463 len[1] = attr_len; 3464 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 3465 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 3466 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 3467 wrapped_data, wrapped_data_len); 3468 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 3469 unwrapped = os_malloc(unwrapped_len); 3470 if (!unwrapped) 3471 goto fail; 3472 if (aes_siv_decrypt(auth->k1, auth->curve->hash_len, 3473 wrapped_data, wrapped_data_len, 3474 2, addr, len, unwrapped) < 0) { 3475 dpp_auth_fail(auth, "AES-SIV decryption failed"); 3476 goto fail; 3477 } 3478 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 3479 unwrapped, unwrapped_len); 3480 3481 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 3482 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 3483 goto fail; 3484 } 3485 3486 i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, 3487 &i_nonce_len); 3488 if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { 3489 dpp_auth_fail(auth, "Missing or invalid I-nonce"); 3490 goto fail; 3491 } 3492 wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); 3493 if (os_memcmp(auth->i_nonce, i_nonce, i_nonce_len) != 0) { 3494 dpp_auth_fail(auth, "I-nonce mismatch"); 3495 goto fail; 3496 } 3497 3498 r_capab = dpp_get_attr(unwrapped, unwrapped_len, 3499 DPP_ATTR_R_CAPABILITIES, 3500 &r_capab_len); 3501 if (!r_capab || r_capab_len < 1) { 3502 dpp_auth_fail(auth, "Missing or invalid R-capabilities"); 3503 goto fail; 3504 } 3505 auth->r_capab = r_capab[0]; 3506 wpa_printf(MSG_DEBUG, "DPP: R-capabilities: 0x%02x", auth->r_capab); 3507 if (status == DPP_STATUS_NOT_COMPATIBLE) { 3508 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_NOT_COMPATIBLE 3509 "r-capab=0x%02x", auth->r_capab); 3510 } else if (status == DPP_STATUS_RESPONSE_PENDING) { 3511 u8 role = auth->r_capab & DPP_CAPAB_ROLE_MASK; 3512 3513 if ((auth->configurator && role != DPP_CAPAB_ENROLLEE) || 3514 (!auth->configurator && role != DPP_CAPAB_CONFIGURATOR)) { 3515 wpa_msg(auth->msg_ctx, MSG_INFO, 3516 DPP_EVENT_FAIL "Unexpected role in R-capabilities 0x%02x", 3517 role); 3518 } else { 3519 wpa_printf(MSG_DEBUG, 3520 "DPP: Continue waiting for full DPP Authentication Response"); 3521 wpa_msg(auth->msg_ctx, MSG_INFO, 3522 DPP_EVENT_RESPONSE_PENDING "%s", 3523 auth->tmp_own_bi ? auth->tmp_own_bi->uri : ""); 3524 } 3525 } 3526 fail: 3527 bin_clear_free(unwrapped, unwrapped_len); 3528 } 3529 3530 3531 struct wpabuf * 3532 dpp_auth_resp_rx(struct dpp_authentication *auth, const u8 *hdr, 3533 const u8 *attr_start, size_t attr_len) 3534 { 3535 EVP_PKEY *pr; 3536 EVP_PKEY_CTX *ctx = NULL; 3537 size_t secret_len; 3538 const u8 *addr[2]; 3539 size_t len[2]; 3540 u8 *unwrapped = NULL, *unwrapped2 = NULL; 3541 size_t unwrapped_len = 0, unwrapped2_len = 0; 3542 const u8 *r_bootstrap, *i_bootstrap, *wrapped_data, *status, *r_proto, 3543 *r_nonce, *i_nonce, *r_capab, *wrapped2, *r_auth; 3544 u16 r_bootstrap_len, i_bootstrap_len, wrapped_data_len, status_len, 3545 r_proto_len, r_nonce_len, i_nonce_len, r_capab_len, 3546 wrapped2_len, r_auth_len; 3547 u8 r_auth2[DPP_MAX_HASH_LEN]; 3548 u8 role; 3549 #ifdef CONFIG_DPP2 3550 const u8 *version; 3551 u16 version_len; 3552 #endif /* CONFIG_DPP2 */ 3553 3554 #ifdef CONFIG_TESTING_OPTIONS 3555 if (dpp_test == DPP_TEST_STOP_AT_AUTH_RESP) { 3556 wpa_printf(MSG_INFO, 3557 "DPP: TESTING - stop at Authentication Response"); 3558 return NULL; 3559 } 3560 #endif /* CONFIG_TESTING_OPTIONS */ 3561 3562 if (!auth->initiator || !auth->peer_bi) { 3563 dpp_auth_fail(auth, "Unexpected Authentication Response"); 3564 return NULL; 3565 } 3566 3567 auth->waiting_auth_resp = 0; 3568 3569 wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, 3570 &wrapped_data_len); 3571 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 3572 dpp_auth_fail(auth, 3573 "Missing or invalid required Wrapped Data attribute"); 3574 return NULL; 3575 } 3576 wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data", 3577 wrapped_data, wrapped_data_len); 3578 3579 attr_len = wrapped_data - 4 - attr_start; 3580 3581 r_bootstrap = dpp_get_attr(attr_start, attr_len, 3582 DPP_ATTR_R_BOOTSTRAP_KEY_HASH, 3583 &r_bootstrap_len); 3584 if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) { 3585 dpp_auth_fail(auth, 3586 "Missing or invalid required Responder Bootstrapping Key Hash attribute"); 3587 return NULL; 3588 } 3589 wpa_hexdump(MSG_DEBUG, "DPP: Responder Bootstrapping Key Hash", 3590 r_bootstrap, r_bootstrap_len); 3591 if (os_memcmp(r_bootstrap, auth->peer_bi->pubkey_hash, 3592 SHA256_MAC_LEN) != 0) { 3593 dpp_auth_fail(auth, 3594 "Unexpected Responder Bootstrapping Key Hash value"); 3595 wpa_hexdump(MSG_DEBUG, 3596 "DPP: Expected Responder Bootstrapping Key Hash", 3597 auth->peer_bi->pubkey_hash, SHA256_MAC_LEN); 3598 return NULL; 3599 } 3600 3601 i_bootstrap = dpp_get_attr(attr_start, attr_len, 3602 DPP_ATTR_I_BOOTSTRAP_KEY_HASH, 3603 &i_bootstrap_len); 3604 if (i_bootstrap) { 3605 if (i_bootstrap_len != SHA256_MAC_LEN) { 3606 dpp_auth_fail(auth, 3607 "Invalid Initiator Bootstrapping Key Hash attribute"); 3608 return NULL; 3609 } 3610 wpa_hexdump(MSG_MSGDUMP, 3611 "DPP: Initiator Bootstrapping Key Hash", 3612 i_bootstrap, i_bootstrap_len); 3613 if (!auth->own_bi || 3614 os_memcmp(i_bootstrap, auth->own_bi->pubkey_hash, 3615 SHA256_MAC_LEN) != 0) { 3616 dpp_auth_fail(auth, 3617 "Initiator Bootstrapping Key Hash attribute did not match"); 3618 return NULL; 3619 } 3620 } else if (auth->own_bi && auth->own_bi->type == DPP_BOOTSTRAP_PKEX) { 3621 /* PKEX bootstrapping mandates use of mutual authentication */ 3622 dpp_auth_fail(auth, 3623 "Missing Initiator Bootstrapping Key Hash attribute"); 3624 return NULL; 3625 } 3626 3627 auth->peer_version = 1; /* default to the first version */ 3628 #ifdef CONFIG_DPP2 3629 version = dpp_get_attr(attr_start, attr_len, DPP_ATTR_PROTOCOL_VERSION, 3630 &version_len); 3631 if (version) { 3632 if (version_len < 1 || version[0] == 0) { 3633 dpp_auth_fail(auth, 3634 "Invalid Protocol Version attribute"); 3635 return NULL; 3636 } 3637 auth->peer_version = version[0]; 3638 wpa_printf(MSG_DEBUG, "DPP: Peer protocol version %u", 3639 auth->peer_version); 3640 } 3641 #endif /* CONFIG_DPP2 */ 3642 3643 status = dpp_get_attr(attr_start, attr_len, DPP_ATTR_STATUS, 3644 &status_len); 3645 if (!status || status_len < 1) { 3646 dpp_auth_fail(auth, 3647 "Missing or invalid required DPP Status attribute"); 3648 return NULL; 3649 } 3650 wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); 3651 auth->auth_resp_status = status[0]; 3652 if (status[0] != DPP_STATUS_OK) { 3653 dpp_auth_resp_rx_status(auth, hdr, attr_start, 3654 attr_len, wrapped_data, 3655 wrapped_data_len, status[0]); 3656 return NULL; 3657 } 3658 3659 if (!i_bootstrap && auth->own_bi) { 3660 wpa_printf(MSG_DEBUG, 3661 "DPP: Responder decided not to use mutual authentication"); 3662 auth->own_bi = NULL; 3663 } 3664 3665 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_AUTH_DIRECTION "mutual=%d", 3666 auth->own_bi != NULL); 3667 3668 r_proto = dpp_get_attr(attr_start, attr_len, DPP_ATTR_R_PROTOCOL_KEY, 3669 &r_proto_len); 3670 if (!r_proto) { 3671 dpp_auth_fail(auth, 3672 "Missing required Responder Protocol Key attribute"); 3673 return NULL; 3674 } 3675 wpa_hexdump(MSG_MSGDUMP, "DPP: Responder Protocol Key", 3676 r_proto, r_proto_len); 3677 3678 /* N = pI * PR */ 3679 pr = dpp_set_pubkey_point(auth->own_protocol_key, r_proto, r_proto_len); 3680 if (!pr) { 3681 dpp_auth_fail(auth, "Invalid Responder Protocol Key"); 3682 return NULL; 3683 } 3684 dpp_debug_print_key("Peer (Responder) Protocol Key", pr); 3685 3686 ctx = EVP_PKEY_CTX_new(auth->own_protocol_key, NULL); 3687 if (!ctx || 3688 EVP_PKEY_derive_init(ctx) != 1 || 3689 EVP_PKEY_derive_set_peer(ctx, pr) != 1 || 3690 EVP_PKEY_derive(ctx, NULL, &secret_len) != 1 || 3691 secret_len > DPP_MAX_SHARED_SECRET_LEN || 3692 EVP_PKEY_derive(ctx, auth->Nx, &secret_len) != 1) { 3693 wpa_printf(MSG_ERROR, 3694 "DPP: Failed to derive ECDH shared secret: %s", 3695 ERR_error_string(ERR_get_error(), NULL)); 3696 dpp_auth_fail(auth, "Failed to derive ECDH shared secret"); 3697 goto fail; 3698 } 3699 EVP_PKEY_CTX_free(ctx); 3700 ctx = NULL; 3701 auth->peer_protocol_key = pr; 3702 pr = NULL; 3703 3704 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)", 3705 auth->Nx, auth->secret_len); 3706 auth->Nx_len = auth->secret_len; 3707 3708 if (dpp_derive_k2(auth->Nx, auth->secret_len, auth->k2, 3709 auth->curve->hash_len) < 0) 3710 goto fail; 3711 3712 addr[0] = hdr; 3713 len[0] = DPP_HDR_LEN; 3714 addr[1] = attr_start; 3715 len[1] = attr_len; 3716 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 3717 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 3718 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 3719 wrapped_data, wrapped_data_len); 3720 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 3721 unwrapped = os_malloc(unwrapped_len); 3722 if (!unwrapped) 3723 goto fail; 3724 if (aes_siv_decrypt(auth->k2, auth->curve->hash_len, 3725 wrapped_data, wrapped_data_len, 3726 2, addr, len, unwrapped) < 0) { 3727 dpp_auth_fail(auth, "AES-SIV decryption failed"); 3728 goto fail; 3729 } 3730 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 3731 unwrapped, unwrapped_len); 3732 3733 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 3734 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 3735 goto fail; 3736 } 3737 3738 r_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_NONCE, 3739 &r_nonce_len); 3740 if (!r_nonce || r_nonce_len != auth->curve->nonce_len) { 3741 dpp_auth_fail(auth, "DPP: Missing or invalid R-nonce"); 3742 goto fail; 3743 } 3744 wpa_hexdump(MSG_DEBUG, "DPP: R-nonce", r_nonce, r_nonce_len); 3745 os_memcpy(auth->r_nonce, r_nonce, r_nonce_len); 3746 3747 i_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_NONCE, 3748 &i_nonce_len); 3749 if (!i_nonce || i_nonce_len != auth->curve->nonce_len) { 3750 dpp_auth_fail(auth, "Missing or invalid I-nonce"); 3751 goto fail; 3752 } 3753 wpa_hexdump(MSG_DEBUG, "DPP: I-nonce", i_nonce, i_nonce_len); 3754 if (os_memcmp(auth->i_nonce, i_nonce, i_nonce_len) != 0) { 3755 dpp_auth_fail(auth, "I-nonce mismatch"); 3756 goto fail; 3757 } 3758 3759 if (auth->own_bi) { 3760 /* Mutual authentication */ 3761 if (dpp_auth_derive_l_initiator(auth) < 0) 3762 goto fail; 3763 } 3764 3765 r_capab = dpp_get_attr(unwrapped, unwrapped_len, 3766 DPP_ATTR_R_CAPABILITIES, 3767 &r_capab_len); 3768 if (!r_capab || r_capab_len < 1) { 3769 dpp_auth_fail(auth, "Missing or invalid R-capabilities"); 3770 goto fail; 3771 } 3772 auth->r_capab = r_capab[0]; 3773 wpa_printf(MSG_DEBUG, "DPP: R-capabilities: 0x%02x", auth->r_capab); 3774 role = auth->r_capab & DPP_CAPAB_ROLE_MASK; 3775 if ((auth->allowed_roles == 3776 (DPP_CAPAB_CONFIGURATOR | DPP_CAPAB_ENROLLEE)) && 3777 (role == DPP_CAPAB_CONFIGURATOR || role == DPP_CAPAB_ENROLLEE)) { 3778 /* Peer selected its role, so move from "either role" to the 3779 * role that is compatible with peer's selection. */ 3780 auth->configurator = role == DPP_CAPAB_ENROLLEE; 3781 wpa_printf(MSG_DEBUG, "DPP: Acting as %s", 3782 auth->configurator ? "Configurator" : "Enrollee"); 3783 } else if ((auth->configurator && role != DPP_CAPAB_ENROLLEE) || 3784 (!auth->configurator && role != DPP_CAPAB_CONFIGURATOR)) { 3785 wpa_printf(MSG_DEBUG, "DPP: Incompatible role selection"); 3786 wpa_msg(auth->msg_ctx, MSG_INFO, DPP_EVENT_FAIL 3787 "Unexpected role in R-capabilities 0x%02x", 3788 role); 3789 if (role != DPP_CAPAB_ENROLLEE && 3790 role != DPP_CAPAB_CONFIGURATOR) 3791 goto fail; 3792 bin_clear_free(unwrapped, unwrapped_len); 3793 auth->remove_on_tx_status = 1; 3794 return dpp_auth_build_conf(auth, DPP_STATUS_NOT_COMPATIBLE); 3795 } 3796 3797 wrapped2 = dpp_get_attr(unwrapped, unwrapped_len, 3798 DPP_ATTR_WRAPPED_DATA, &wrapped2_len); 3799 if (!wrapped2 || wrapped2_len < AES_BLOCK_SIZE) { 3800 dpp_auth_fail(auth, 3801 "Missing or invalid Secondary Wrapped Data"); 3802 goto fail; 3803 } 3804 3805 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 3806 wrapped2, wrapped2_len); 3807 3808 if (dpp_derive_ke(auth, auth->ke, auth->curve->hash_len) < 0) 3809 goto fail; 3810 3811 unwrapped2_len = wrapped2_len - AES_BLOCK_SIZE; 3812 unwrapped2 = os_malloc(unwrapped2_len); 3813 if (!unwrapped2) 3814 goto fail; 3815 if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, 3816 wrapped2, wrapped2_len, 3817 0, NULL, NULL, unwrapped2) < 0) { 3818 dpp_auth_fail(auth, "AES-SIV decryption failed"); 3819 goto fail; 3820 } 3821 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 3822 unwrapped2, unwrapped2_len); 3823 3824 if (dpp_check_attrs(unwrapped2, unwrapped2_len) < 0) { 3825 dpp_auth_fail(auth, 3826 "Invalid attribute in secondary unwrapped data"); 3827 goto fail; 3828 } 3829 3830 r_auth = dpp_get_attr(unwrapped2, unwrapped2_len, DPP_ATTR_R_AUTH_TAG, 3831 &r_auth_len); 3832 if (!r_auth || r_auth_len != auth->curve->hash_len) { 3833 dpp_auth_fail(auth, 3834 "Missing or invalid Responder Authenticating Tag"); 3835 goto fail; 3836 } 3837 wpa_hexdump(MSG_DEBUG, "DPP: Received Responder Authenticating Tag", 3838 r_auth, r_auth_len); 3839 /* R-auth' = H(I-nonce | R-nonce | PI.x | PR.x | [BI.x |] BR.x | 0) */ 3840 if (dpp_gen_r_auth(auth, r_auth2) < 0) 3841 goto fail; 3842 wpa_hexdump(MSG_DEBUG, "DPP: Calculated Responder Authenticating Tag", 3843 r_auth2, r_auth_len); 3844 if (os_memcmp(r_auth, r_auth2, r_auth_len) != 0) { 3845 dpp_auth_fail(auth, "Mismatching Responder Authenticating Tag"); 3846 bin_clear_free(unwrapped, unwrapped_len); 3847 bin_clear_free(unwrapped2, unwrapped2_len); 3848 auth->remove_on_tx_status = 1; 3849 return dpp_auth_build_conf(auth, DPP_STATUS_AUTH_FAILURE); 3850 } 3851 3852 bin_clear_free(unwrapped, unwrapped_len); 3853 bin_clear_free(unwrapped2, unwrapped2_len); 3854 3855 #ifdef CONFIG_TESTING_OPTIONS 3856 if (dpp_test == DPP_TEST_AUTH_RESP_IN_PLACE_OF_CONF) { 3857 wpa_printf(MSG_INFO, 3858 "DPP: TESTING - Authentication Response in place of Confirm"); 3859 if (dpp_auth_build_resp_ok(auth) < 0) 3860 return NULL; 3861 return wpabuf_dup(auth->resp_msg); 3862 } 3863 #endif /* CONFIG_TESTING_OPTIONS */ 3864 3865 return dpp_auth_build_conf(auth, DPP_STATUS_OK); 3866 3867 fail: 3868 bin_clear_free(unwrapped, unwrapped_len); 3869 bin_clear_free(unwrapped2, unwrapped2_len); 3870 EVP_PKEY_free(pr); 3871 EVP_PKEY_CTX_free(ctx); 3872 return NULL; 3873 } 3874 3875 3876 static int dpp_auth_conf_rx_failure(struct dpp_authentication *auth, 3877 const u8 *hdr, 3878 const u8 *attr_start, size_t attr_len, 3879 const u8 *wrapped_data, 3880 u16 wrapped_data_len, 3881 enum dpp_status_error status) 3882 { 3883 const u8 *addr[2]; 3884 size_t len[2]; 3885 u8 *unwrapped = NULL; 3886 size_t unwrapped_len = 0; 3887 const u8 *r_nonce; 3888 u16 r_nonce_len; 3889 3890 /* Authentication Confirm failure cases are expected to include 3891 * {R-nonce}k2 in the Wrapped Data attribute. */ 3892 3893 addr[0] = hdr; 3894 len[0] = DPP_HDR_LEN; 3895 addr[1] = attr_start; 3896 len[1] = attr_len; 3897 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 3898 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 3899 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 3900 wrapped_data, wrapped_data_len); 3901 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 3902 unwrapped = os_malloc(unwrapped_len); 3903 if (!unwrapped) { 3904 dpp_auth_fail(auth, "Authentication failed"); 3905 goto fail; 3906 } 3907 if (aes_siv_decrypt(auth->k2, auth->curve->hash_len, 3908 wrapped_data, wrapped_data_len, 3909 2, addr, len, unwrapped) < 0) { 3910 dpp_auth_fail(auth, "AES-SIV decryption failed"); 3911 goto fail; 3912 } 3913 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 3914 unwrapped, unwrapped_len); 3915 3916 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 3917 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 3918 goto fail; 3919 } 3920 3921 r_nonce = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_NONCE, 3922 &r_nonce_len); 3923 if (!r_nonce || r_nonce_len != auth->curve->nonce_len) { 3924 dpp_auth_fail(auth, "DPP: Missing or invalid R-nonce"); 3925 goto fail; 3926 } 3927 if (os_memcmp(r_nonce, auth->r_nonce, r_nonce_len) != 0) { 3928 wpa_hexdump(MSG_DEBUG, "DPP: Received R-nonce", 3929 r_nonce, r_nonce_len); 3930 wpa_hexdump(MSG_DEBUG, "DPP: Expected R-nonce", 3931 auth->r_nonce, r_nonce_len); 3932 dpp_auth_fail(auth, "R-nonce mismatch"); 3933 goto fail; 3934 } 3935 3936 if (status == DPP_STATUS_NOT_COMPATIBLE) 3937 dpp_auth_fail(auth, "Peer reported incompatible R-capab role"); 3938 else if (status == DPP_STATUS_AUTH_FAILURE) 3939 dpp_auth_fail(auth, "Peer reported authentication failure)"); 3940 3941 fail: 3942 bin_clear_free(unwrapped, unwrapped_len); 3943 return -1; 3944 } 3945 3946 3947 int dpp_auth_conf_rx(struct dpp_authentication *auth, const u8 *hdr, 3948 const u8 *attr_start, size_t attr_len) 3949 { 3950 const u8 *r_bootstrap, *i_bootstrap, *wrapped_data, *status, *i_auth; 3951 u16 r_bootstrap_len, i_bootstrap_len, wrapped_data_len, status_len, 3952 i_auth_len; 3953 const u8 *addr[2]; 3954 size_t len[2]; 3955 u8 *unwrapped = NULL; 3956 size_t unwrapped_len = 0; 3957 u8 i_auth2[DPP_MAX_HASH_LEN]; 3958 3959 #ifdef CONFIG_TESTING_OPTIONS 3960 if (dpp_test == DPP_TEST_STOP_AT_AUTH_CONF) { 3961 wpa_printf(MSG_INFO, 3962 "DPP: TESTING - stop at Authentication Confirm"); 3963 return -1; 3964 } 3965 #endif /* CONFIG_TESTING_OPTIONS */ 3966 3967 if (auth->initiator || !auth->own_bi) { 3968 dpp_auth_fail(auth, "Unexpected Authentication Confirm"); 3969 return -1; 3970 } 3971 3972 auth->waiting_auth_conf = 0; 3973 3974 wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, 3975 &wrapped_data_len); 3976 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 3977 dpp_auth_fail(auth, 3978 "Missing or invalid required Wrapped Data attribute"); 3979 return -1; 3980 } 3981 wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data", 3982 wrapped_data, wrapped_data_len); 3983 3984 attr_len = wrapped_data - 4 - attr_start; 3985 3986 r_bootstrap = dpp_get_attr(attr_start, attr_len, 3987 DPP_ATTR_R_BOOTSTRAP_KEY_HASH, 3988 &r_bootstrap_len); 3989 if (!r_bootstrap || r_bootstrap_len != SHA256_MAC_LEN) { 3990 dpp_auth_fail(auth, 3991 "Missing or invalid required Responder Bootstrapping Key Hash attribute"); 3992 return -1; 3993 } 3994 wpa_hexdump(MSG_DEBUG, "DPP: Responder Bootstrapping Key Hash", 3995 r_bootstrap, r_bootstrap_len); 3996 if (os_memcmp(r_bootstrap, auth->own_bi->pubkey_hash, 3997 SHA256_MAC_LEN) != 0) { 3998 wpa_hexdump(MSG_DEBUG, 3999 "DPP: Expected Responder Bootstrapping Key Hash", 4000 auth->peer_bi->pubkey_hash, SHA256_MAC_LEN); 4001 dpp_auth_fail(auth, 4002 "Responder Bootstrapping Key Hash mismatch"); 4003 return -1; 4004 } 4005 4006 i_bootstrap = dpp_get_attr(attr_start, attr_len, 4007 DPP_ATTR_I_BOOTSTRAP_KEY_HASH, 4008 &i_bootstrap_len); 4009 if (i_bootstrap) { 4010 if (i_bootstrap_len != SHA256_MAC_LEN) { 4011 dpp_auth_fail(auth, 4012 "Invalid Initiator Bootstrapping Key Hash attribute"); 4013 return -1; 4014 } 4015 wpa_hexdump(MSG_MSGDUMP, 4016 "DPP: Initiator Bootstrapping Key Hash", 4017 i_bootstrap, i_bootstrap_len); 4018 if (!auth->peer_bi || 4019 os_memcmp(i_bootstrap, auth->peer_bi->pubkey_hash, 4020 SHA256_MAC_LEN) != 0) { 4021 dpp_auth_fail(auth, 4022 "Initiator Bootstrapping Key Hash mismatch"); 4023 return -1; 4024 } 4025 } else if (auth->peer_bi) { 4026 /* Mutual authentication and peer did not include its 4027 * Bootstrapping Key Hash attribute. */ 4028 dpp_auth_fail(auth, 4029 "Missing Initiator Bootstrapping Key Hash attribute"); 4030 return -1; 4031 } 4032 4033 status = dpp_get_attr(attr_start, attr_len, DPP_ATTR_STATUS, 4034 &status_len); 4035 if (!status || status_len < 1) { 4036 dpp_auth_fail(auth, 4037 "Missing or invalid required DPP Status attribute"); 4038 return -1; 4039 } 4040 wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); 4041 if (status[0] == DPP_STATUS_NOT_COMPATIBLE || 4042 status[0] == DPP_STATUS_AUTH_FAILURE) 4043 return dpp_auth_conf_rx_failure(auth, hdr, attr_start, 4044 attr_len, wrapped_data, 4045 wrapped_data_len, status[0]); 4046 4047 if (status[0] != DPP_STATUS_OK) { 4048 dpp_auth_fail(auth, "Authentication failed"); 4049 return -1; 4050 } 4051 4052 addr[0] = hdr; 4053 len[0] = DPP_HDR_LEN; 4054 addr[1] = attr_start; 4055 len[1] = attr_len; 4056 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 4057 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 4058 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 4059 wrapped_data, wrapped_data_len); 4060 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 4061 unwrapped = os_malloc(unwrapped_len); 4062 if (!unwrapped) 4063 return -1; 4064 if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, 4065 wrapped_data, wrapped_data_len, 4066 2, addr, len, unwrapped) < 0) { 4067 dpp_auth_fail(auth, "AES-SIV decryption failed"); 4068 goto fail; 4069 } 4070 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 4071 unwrapped, unwrapped_len); 4072 4073 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 4074 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 4075 goto fail; 4076 } 4077 4078 i_auth = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_AUTH_TAG, 4079 &i_auth_len); 4080 if (!i_auth || i_auth_len != auth->curve->hash_len) { 4081 dpp_auth_fail(auth, 4082 "Missing or invalid Initiator Authenticating Tag"); 4083 goto fail; 4084 } 4085 wpa_hexdump(MSG_DEBUG, "DPP: Received Initiator Authenticating Tag", 4086 i_auth, i_auth_len); 4087 /* I-auth' = H(R-nonce | I-nonce | PR.x | PI.x | BR.x | [BI.x |] 1) */ 4088 if (dpp_gen_i_auth(auth, i_auth2) < 0) 4089 goto fail; 4090 wpa_hexdump(MSG_DEBUG, "DPP: Calculated Initiator Authenticating Tag", 4091 i_auth2, i_auth_len); 4092 if (os_memcmp(i_auth, i_auth2, i_auth_len) != 0) { 4093 dpp_auth_fail(auth, "Mismatching Initiator Authenticating Tag"); 4094 goto fail; 4095 } 4096 4097 bin_clear_free(unwrapped, unwrapped_len); 4098 dpp_auth_success(auth); 4099 return 0; 4100 fail: 4101 bin_clear_free(unwrapped, unwrapped_len); 4102 return -1; 4103 } 4104 4105 4106 static int bin_str_eq(const char *val, size_t len, const char *cmp) 4107 { 4108 return os_strlen(cmp) == len && os_memcmp(val, cmp, len) == 0; 4109 } 4110 4111 4112 struct dpp_configuration * dpp_configuration_alloc(const char *type) 4113 { 4114 struct dpp_configuration *conf; 4115 const char *end; 4116 size_t len; 4117 4118 conf = os_zalloc(sizeof(*conf)); 4119 if (!conf) 4120 goto fail; 4121 4122 end = os_strchr(type, ' '); 4123 if (end) 4124 len = end - type; 4125 else 4126 len = os_strlen(type); 4127 4128 if (bin_str_eq(type, len, "psk")) 4129 conf->akm = DPP_AKM_PSK; 4130 else if (bin_str_eq(type, len, "sae")) 4131 conf->akm = DPP_AKM_SAE; 4132 else if (bin_str_eq(type, len, "psk-sae") || 4133 bin_str_eq(type, len, "psk+sae")) 4134 conf->akm = DPP_AKM_PSK_SAE; 4135 else if (bin_str_eq(type, len, "sae-dpp") || 4136 bin_str_eq(type, len, "dpp+sae")) 4137 conf->akm = DPP_AKM_SAE_DPP; 4138 else if (bin_str_eq(type, len, "psk-sae-dpp") || 4139 bin_str_eq(type, len, "dpp+psk+sae")) 4140 conf->akm = DPP_AKM_PSK_SAE_DPP; 4141 else if (bin_str_eq(type, len, "dpp")) 4142 conf->akm = DPP_AKM_DPP; 4143 else 4144 goto fail; 4145 4146 return conf; 4147 fail: 4148 dpp_configuration_free(conf); 4149 return NULL; 4150 } 4151 4152 4153 int dpp_akm_psk(enum dpp_akm akm) 4154 { 4155 return akm == DPP_AKM_PSK || akm == DPP_AKM_PSK_SAE || 4156 akm == DPP_AKM_PSK_SAE_DPP; 4157 } 4158 4159 4160 int dpp_akm_sae(enum dpp_akm akm) 4161 { 4162 return akm == DPP_AKM_SAE || akm == DPP_AKM_PSK_SAE || 4163 akm == DPP_AKM_SAE_DPP || akm == DPP_AKM_PSK_SAE_DPP; 4164 } 4165 4166 4167 int dpp_akm_legacy(enum dpp_akm akm) 4168 { 4169 return akm == DPP_AKM_PSK || akm == DPP_AKM_PSK_SAE || 4170 akm == DPP_AKM_SAE; 4171 } 4172 4173 4174 int dpp_akm_dpp(enum dpp_akm akm) 4175 { 4176 return akm == DPP_AKM_DPP || akm == DPP_AKM_SAE_DPP || 4177 akm == DPP_AKM_PSK_SAE_DPP; 4178 } 4179 4180 4181 int dpp_akm_ver2(enum dpp_akm akm) 4182 { 4183 return akm == DPP_AKM_SAE_DPP || akm == DPP_AKM_PSK_SAE_DPP; 4184 } 4185 4186 4187 int dpp_configuration_valid(const struct dpp_configuration *conf) 4188 { 4189 if (conf->ssid_len == 0) 4190 return 0; 4191 if (dpp_akm_psk(conf->akm) && !conf->passphrase && !conf->psk_set) 4192 return 0; 4193 if (dpp_akm_sae(conf->akm) && !conf->passphrase) 4194 return 0; 4195 return 1; 4196 } 4197 4198 4199 void dpp_configuration_free(struct dpp_configuration *conf) 4200 { 4201 if (!conf) 4202 return; 4203 str_clear_free(conf->passphrase); 4204 os_free(conf->group_id); 4205 bin_clear_free(conf, sizeof(*conf)); 4206 } 4207 4208 4209 static int dpp_configuration_parse(struct dpp_authentication *auth, 4210 const char *cmd) 4211 { 4212 const char *pos, *end; 4213 struct dpp_configuration *conf_sta = NULL, *conf_ap = NULL; 4214 struct dpp_configuration *conf = NULL; 4215 4216 pos = os_strstr(cmd, " conf=sta-"); 4217 if (pos) { 4218 conf_sta = dpp_configuration_alloc(pos + 10); 4219 if (!conf_sta) 4220 goto fail; 4221 conf = conf_sta; 4222 } 4223 4224 pos = os_strstr(cmd, " conf=ap-"); 4225 if (pos) { 4226 conf_ap = dpp_configuration_alloc(pos + 9); 4227 if (!conf_ap) 4228 goto fail; 4229 conf = conf_ap; 4230 } 4231 4232 if (!conf) 4233 return 0; 4234 4235 pos = os_strstr(cmd, " ssid="); 4236 if (pos) { 4237 pos += 6; 4238 end = os_strchr(pos, ' '); 4239 conf->ssid_len = end ? (size_t) (end - pos) : os_strlen(pos); 4240 conf->ssid_len /= 2; 4241 if (conf->ssid_len > sizeof(conf->ssid) || 4242 hexstr2bin(pos, conf->ssid, conf->ssid_len) < 0) 4243 goto fail; 4244 } else { 4245 #ifdef CONFIG_TESTING_OPTIONS 4246 /* use a default SSID for legacy testing reasons */ 4247 os_memcpy(conf->ssid, "test", 4); 4248 conf->ssid_len = 4; 4249 #else /* CONFIG_TESTING_OPTIONS */ 4250 goto fail; 4251 #endif /* CONFIG_TESTING_OPTIONS */ 4252 } 4253 4254 pos = os_strstr(cmd, " pass="); 4255 if (pos) { 4256 size_t pass_len; 4257 4258 pos += 6; 4259 end = os_strchr(pos, ' '); 4260 pass_len = end ? (size_t) (end - pos) : os_strlen(pos); 4261 pass_len /= 2; 4262 if (pass_len > 63 || pass_len < 8) 4263 goto fail; 4264 conf->passphrase = os_zalloc(pass_len + 1); 4265 if (!conf->passphrase || 4266 hexstr2bin(pos, (u8 *) conf->passphrase, pass_len) < 0) 4267 goto fail; 4268 } 4269 4270 pos = os_strstr(cmd, " psk="); 4271 if (pos) { 4272 pos += 5; 4273 if (hexstr2bin(pos, conf->psk, PMK_LEN) < 0) 4274 goto fail; 4275 conf->psk_set = 1; 4276 } 4277 4278 pos = os_strstr(cmd, " group_id="); 4279 if (pos) { 4280 size_t group_id_len; 4281 4282 pos += 10; 4283 end = os_strchr(pos, ' '); 4284 group_id_len = end ? (size_t) (end - pos) : os_strlen(pos); 4285 conf->group_id = os_malloc(group_id_len + 1); 4286 if (!conf->group_id) 4287 goto fail; 4288 os_memcpy(conf->group_id, pos, group_id_len); 4289 conf->group_id[group_id_len] = '\0'; 4290 } 4291 4292 pos = os_strstr(cmd, " expiry="); 4293 if (pos) { 4294 long int val; 4295 4296 pos += 8; 4297 val = strtol(pos, NULL, 0); 4298 if (val <= 0) 4299 goto fail; 4300 conf->netaccesskey_expiry = val; 4301 } 4302 4303 if (!dpp_configuration_valid(conf)) 4304 goto fail; 4305 4306 auth->conf_sta = conf_sta; 4307 auth->conf_ap = conf_ap; 4308 return 0; 4309 4310 fail: 4311 dpp_configuration_free(conf_sta); 4312 dpp_configuration_free(conf_ap); 4313 return -1; 4314 } 4315 4316 4317 static struct dpp_configurator * 4318 dpp_configurator_get_id(struct dpp_global *dpp, unsigned int id) 4319 { 4320 struct dpp_configurator *conf; 4321 4322 if (!dpp) 4323 return NULL; 4324 4325 dl_list_for_each(conf, &dpp->configurator, 4326 struct dpp_configurator, list) { 4327 if (conf->id == id) 4328 return conf; 4329 } 4330 return NULL; 4331 } 4332 4333 4334 int dpp_set_configurator(struct dpp_global *dpp, void *msg_ctx, 4335 struct dpp_authentication *auth, 4336 const char *cmd) 4337 { 4338 const char *pos; 4339 4340 if (!cmd) 4341 return 0; 4342 4343 wpa_printf(MSG_DEBUG, "DPP: Set configurator parameters: %s", cmd); 4344 4345 pos = os_strstr(cmd, " configurator="); 4346 if (pos) { 4347 pos += 14; 4348 auth->conf = dpp_configurator_get_id(dpp, atoi(pos)); 4349 if (!auth->conf) { 4350 wpa_printf(MSG_INFO, 4351 "DPP: Could not find the specified configurator"); 4352 return -1; 4353 } 4354 } 4355 4356 if (dpp_configuration_parse(auth, cmd) < 0) { 4357 wpa_msg(msg_ctx, MSG_INFO, 4358 "DPP: Failed to set configurator parameters"); 4359 return -1; 4360 } 4361 return 0; 4362 } 4363 4364 4365 void dpp_auth_deinit(struct dpp_authentication *auth) 4366 { 4367 if (!auth) 4368 return; 4369 dpp_configuration_free(auth->conf_ap); 4370 dpp_configuration_free(auth->conf_sta); 4371 EVP_PKEY_free(auth->own_protocol_key); 4372 EVP_PKEY_free(auth->peer_protocol_key); 4373 wpabuf_free(auth->req_msg); 4374 wpabuf_free(auth->resp_msg); 4375 wpabuf_free(auth->conf_req); 4376 os_free(auth->connector); 4377 wpabuf_free(auth->net_access_key); 4378 wpabuf_free(auth->c_sign_key); 4379 dpp_bootstrap_info_free(auth->tmp_own_bi); 4380 #ifdef CONFIG_TESTING_OPTIONS 4381 os_free(auth->config_obj_override); 4382 os_free(auth->discovery_override); 4383 os_free(auth->groups_override); 4384 #endif /* CONFIG_TESTING_OPTIONS */ 4385 bin_clear_free(auth, sizeof(*auth)); 4386 } 4387 4388 4389 static struct wpabuf * 4390 dpp_build_conf_start(struct dpp_authentication *auth, 4391 struct dpp_configuration *conf, size_t tailroom) 4392 { 4393 struct wpabuf *buf; 4394 char ssid[6 * sizeof(conf->ssid) + 1]; 4395 4396 #ifdef CONFIG_TESTING_OPTIONS 4397 if (auth->discovery_override) 4398 tailroom += os_strlen(auth->discovery_override); 4399 #endif /* CONFIG_TESTING_OPTIONS */ 4400 4401 buf = wpabuf_alloc(200 + tailroom); 4402 if (!buf) 4403 return NULL; 4404 wpabuf_put_str(buf, "{\"wi-fi_tech\":\"infra\",\"discovery\":"); 4405 #ifdef CONFIG_TESTING_OPTIONS 4406 if (auth->discovery_override) { 4407 wpa_printf(MSG_DEBUG, "DPP: TESTING - discovery override: '%s'", 4408 auth->discovery_override); 4409 wpabuf_put_str(buf, auth->discovery_override); 4410 wpabuf_put_u8(buf, ','); 4411 return buf; 4412 } 4413 #endif /* CONFIG_TESTING_OPTIONS */ 4414 wpabuf_put_str(buf, "{\"ssid\":\""); 4415 json_escape_string(ssid, sizeof(ssid), 4416 (const char *) conf->ssid, conf->ssid_len); 4417 wpabuf_put_str(buf, ssid); 4418 wpabuf_put_str(buf, "\"},"); 4419 4420 return buf; 4421 } 4422 4423 4424 static int dpp_build_jwk(struct wpabuf *buf, const char *name, EVP_PKEY *key, 4425 const char *kid, const struct dpp_curve_params *curve) 4426 { 4427 struct wpabuf *pub; 4428 const u8 *pos; 4429 char *x = NULL, *y = NULL; 4430 int ret = -1; 4431 4432 pub = dpp_get_pubkey_point(key, 0); 4433 if (!pub) 4434 goto fail; 4435 pos = wpabuf_head(pub); 4436 x = (char *) base64_url_encode(pos, curve->prime_len, NULL, 0); 4437 pos += curve->prime_len; 4438 y = (char *) base64_url_encode(pos, curve->prime_len, NULL, 0); 4439 if (!x || !y) 4440 goto fail; 4441 4442 wpabuf_put_str(buf, "\""); 4443 wpabuf_put_str(buf, name); 4444 wpabuf_put_str(buf, "\":{\"kty\":\"EC\",\"crv\":\""); 4445 wpabuf_put_str(buf, curve->jwk_crv); 4446 wpabuf_put_str(buf, "\",\"x\":\""); 4447 wpabuf_put_str(buf, x); 4448 wpabuf_put_str(buf, "\",\"y\":\""); 4449 wpabuf_put_str(buf, y); 4450 if (kid) { 4451 wpabuf_put_str(buf, "\",\"kid\":\""); 4452 wpabuf_put_str(buf, kid); 4453 } 4454 wpabuf_put_str(buf, "\"}"); 4455 ret = 0; 4456 fail: 4457 wpabuf_free(pub); 4458 os_free(x); 4459 os_free(y); 4460 return ret; 4461 } 4462 4463 4464 static void dpp_build_legacy_cred_params(struct wpabuf *buf, 4465 struct dpp_configuration *conf) 4466 { 4467 if (conf->passphrase && os_strlen(conf->passphrase) < 64) { 4468 char pass[63 * 6 + 1]; 4469 4470 json_escape_string(pass, sizeof(pass), conf->passphrase, 4471 os_strlen(conf->passphrase)); 4472 wpabuf_put_str(buf, "\"pass\":\""); 4473 wpabuf_put_str(buf, pass); 4474 wpabuf_put_str(buf, "\""); 4475 os_memset(pass, 0, sizeof(pass)); 4476 } else if (conf->psk_set) { 4477 char psk[2 * sizeof(conf->psk) + 1]; 4478 4479 wpa_snprintf_hex(psk, sizeof(psk), 4480 conf->psk, sizeof(conf->psk)); 4481 wpabuf_put_str(buf, "\"psk_hex\":\""); 4482 wpabuf_put_str(buf, psk); 4483 wpabuf_put_str(buf, "\""); 4484 os_memset(psk, 0, sizeof(psk)); 4485 } 4486 } 4487 4488 4489 static struct wpabuf * 4490 dpp_build_conf_obj_dpp(struct dpp_authentication *auth, int ap, 4491 struct dpp_configuration *conf) 4492 { 4493 struct wpabuf *buf = NULL; 4494 char *signed1 = NULL, *signed2 = NULL, *signed3 = NULL; 4495 size_t tailroom; 4496 const struct dpp_curve_params *curve; 4497 char jws_prot_hdr[100]; 4498 size_t signed1_len, signed2_len, signed3_len; 4499 struct wpabuf *dppcon = NULL; 4500 unsigned char *signature = NULL; 4501 const unsigned char *p; 4502 size_t signature_len; 4503 EVP_MD_CTX *md_ctx = NULL; 4504 ECDSA_SIG *sig = NULL; 4505 char *dot = "."; 4506 const EVP_MD *sign_md; 4507 const BIGNUM *r, *s; 4508 size_t extra_len = 1000; 4509 int incl_legacy; 4510 enum dpp_akm akm; 4511 4512 if (!auth->conf) { 4513 wpa_printf(MSG_INFO, 4514 "DPP: No configurator specified - cannot generate DPP config object"); 4515 goto fail; 4516 } 4517 curve = auth->conf->curve; 4518 if (curve->hash_len == SHA256_MAC_LEN) { 4519 sign_md = EVP_sha256(); 4520 } else if (curve->hash_len == SHA384_MAC_LEN) { 4521 sign_md = EVP_sha384(); 4522 } else if (curve->hash_len == SHA512_MAC_LEN) { 4523 sign_md = EVP_sha512(); 4524 } else { 4525 wpa_printf(MSG_DEBUG, "DPP: Unknown signature algorithm"); 4526 goto fail; 4527 } 4528 4529 akm = conf->akm; 4530 if (dpp_akm_ver2(akm) && auth->peer_version < 2) { 4531 wpa_printf(MSG_DEBUG, 4532 "DPP: Convert DPP+legacy credential to DPP-only for peer that does not support version 2"); 4533 akm = DPP_AKM_DPP; 4534 } 4535 4536 #ifdef CONFIG_TESTING_OPTIONS 4537 if (auth->groups_override) 4538 extra_len += os_strlen(auth->groups_override); 4539 #endif /* CONFIG_TESTING_OPTIONS */ 4540 4541 if (conf->group_id) 4542 extra_len += os_strlen(conf->group_id); 4543 4544 /* Connector (JSON dppCon object) */ 4545 dppcon = wpabuf_alloc(extra_len + 2 * auth->curve->prime_len * 4 / 3); 4546 if (!dppcon) 4547 goto fail; 4548 #ifdef CONFIG_TESTING_OPTIONS 4549 if (auth->groups_override) { 4550 wpabuf_put_u8(dppcon, '{'); 4551 if (auth->groups_override) { 4552 wpa_printf(MSG_DEBUG, 4553 "DPP: TESTING - groups override: '%s'", 4554 auth->groups_override); 4555 wpabuf_put_str(dppcon, "\"groups\":"); 4556 wpabuf_put_str(dppcon, auth->groups_override); 4557 wpabuf_put_u8(dppcon, ','); 4558 } 4559 goto skip_groups; 4560 } 4561 #endif /* CONFIG_TESTING_OPTIONS */ 4562 wpabuf_printf(dppcon, "{\"groups\":[{\"groupId\":\"%s\",", 4563 conf->group_id ? conf->group_id : "*"); 4564 wpabuf_printf(dppcon, "\"netRole\":\"%s\"}],", ap ? "ap" : "sta"); 4565 #ifdef CONFIG_TESTING_OPTIONS 4566 skip_groups: 4567 #endif /* CONFIG_TESTING_OPTIONS */ 4568 if (dpp_build_jwk(dppcon, "netAccessKey", auth->peer_protocol_key, NULL, 4569 auth->curve) < 0) { 4570 wpa_printf(MSG_DEBUG, "DPP: Failed to build netAccessKey JWK"); 4571 goto fail; 4572 } 4573 if (conf->netaccesskey_expiry) { 4574 struct os_tm tm; 4575 4576 if (os_gmtime(conf->netaccesskey_expiry, &tm) < 0) { 4577 wpa_printf(MSG_DEBUG, 4578 "DPP: Failed to generate expiry string"); 4579 goto fail; 4580 } 4581 wpabuf_printf(dppcon, 4582 ",\"expiry\":\"%04u-%02u-%02uT%02u:%02u:%02uZ\"", 4583 tm.year, tm.month, tm.day, 4584 tm.hour, tm.min, tm.sec); 4585 } 4586 wpabuf_put_u8(dppcon, '}'); 4587 wpa_printf(MSG_DEBUG, "DPP: dppCon: %s", 4588 (const char *) wpabuf_head(dppcon)); 4589 4590 os_snprintf(jws_prot_hdr, sizeof(jws_prot_hdr), 4591 "{\"typ\":\"dppCon\",\"kid\":\"%s\",\"alg\":\"%s\"}", 4592 auth->conf->kid, curve->jws_alg); 4593 signed1 = (char *) base64_url_encode((unsigned char *) jws_prot_hdr, 4594 os_strlen(jws_prot_hdr), 4595 &signed1_len, 0); 4596 signed2 = (char *) base64_url_encode(wpabuf_head(dppcon), 4597 wpabuf_len(dppcon), 4598 &signed2_len, 0); 4599 if (!signed1 || !signed2) 4600 goto fail; 4601 4602 md_ctx = EVP_MD_CTX_create(); 4603 if (!md_ctx) 4604 goto fail; 4605 4606 ERR_clear_error(); 4607 if (EVP_DigestSignInit(md_ctx, NULL, sign_md, NULL, 4608 auth->conf->csign) != 1) { 4609 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignInit failed: %s", 4610 ERR_error_string(ERR_get_error(), NULL)); 4611 goto fail; 4612 } 4613 if (EVP_DigestSignUpdate(md_ctx, signed1, signed1_len) != 1 || 4614 EVP_DigestSignUpdate(md_ctx, dot, 1) != 1 || 4615 EVP_DigestSignUpdate(md_ctx, signed2, signed2_len) != 1) { 4616 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignUpdate failed: %s", 4617 ERR_error_string(ERR_get_error(), NULL)); 4618 goto fail; 4619 } 4620 if (EVP_DigestSignFinal(md_ctx, NULL, &signature_len) != 1) { 4621 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignFinal failed: %s", 4622 ERR_error_string(ERR_get_error(), NULL)); 4623 goto fail; 4624 } 4625 signature = os_malloc(signature_len); 4626 if (!signature) 4627 goto fail; 4628 if (EVP_DigestSignFinal(md_ctx, signature, &signature_len) != 1) { 4629 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestSignFinal failed: %s", 4630 ERR_error_string(ERR_get_error(), NULL)); 4631 goto fail; 4632 } 4633 wpa_hexdump(MSG_DEBUG, "DPP: signedConnector ECDSA signature (DER)", 4634 signature, signature_len); 4635 /* Convert to raw coordinates r,s */ 4636 p = signature; 4637 sig = d2i_ECDSA_SIG(NULL, &p, signature_len); 4638 if (!sig) 4639 goto fail; 4640 ECDSA_SIG_get0(sig, &r, &s); 4641 if (dpp_bn2bin_pad(r, signature, curve->prime_len) < 0 || 4642 dpp_bn2bin_pad(s, signature + curve->prime_len, 4643 curve->prime_len) < 0) 4644 goto fail; 4645 signature_len = 2 * curve->prime_len; 4646 wpa_hexdump(MSG_DEBUG, "DPP: signedConnector ECDSA signature (raw r,s)", 4647 signature, signature_len); 4648 signed3 = (char *) base64_url_encode(signature, signature_len, 4649 &signed3_len, 0); 4650 if (!signed3) 4651 goto fail; 4652 4653 incl_legacy = dpp_akm_psk(akm) || dpp_akm_sae(akm); 4654 tailroom = 1000; 4655 tailroom += 2 * curve->prime_len * 4 / 3 + os_strlen(auth->conf->kid); 4656 tailroom += signed1_len + signed2_len + signed3_len; 4657 if (incl_legacy) 4658 tailroom += 1000; 4659 buf = dpp_build_conf_start(auth, conf, tailroom); 4660 if (!buf) 4661 goto fail; 4662 4663 wpabuf_printf(buf, "\"cred\":{\"akm\":\"%s\",", dpp_akm_str(akm)); 4664 if (incl_legacy) { 4665 dpp_build_legacy_cred_params(buf, conf); 4666 wpabuf_put_str(buf, ","); 4667 } 4668 wpabuf_put_str(buf, "\"signedConnector\":\""); 4669 wpabuf_put_str(buf, signed1); 4670 wpabuf_put_u8(buf, '.'); 4671 wpabuf_put_str(buf, signed2); 4672 wpabuf_put_u8(buf, '.'); 4673 wpabuf_put_str(buf, signed3); 4674 wpabuf_put_str(buf, "\","); 4675 if (dpp_build_jwk(buf, "csign", auth->conf->csign, auth->conf->kid, 4676 curve) < 0) { 4677 wpa_printf(MSG_DEBUG, "DPP: Failed to build csign JWK"); 4678 goto fail; 4679 } 4680 4681 wpabuf_put_str(buf, "}}"); 4682 4683 wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object", 4684 wpabuf_head(buf), wpabuf_len(buf)); 4685 4686 out: 4687 EVP_MD_CTX_destroy(md_ctx); 4688 ECDSA_SIG_free(sig); 4689 os_free(signed1); 4690 os_free(signed2); 4691 os_free(signed3); 4692 os_free(signature); 4693 wpabuf_free(dppcon); 4694 return buf; 4695 fail: 4696 wpa_printf(MSG_DEBUG, "DPP: Failed to build configuration object"); 4697 wpabuf_free(buf); 4698 buf = NULL; 4699 goto out; 4700 } 4701 4702 4703 static struct wpabuf * 4704 dpp_build_conf_obj_legacy(struct dpp_authentication *auth, int ap, 4705 struct dpp_configuration *conf) 4706 { 4707 struct wpabuf *buf; 4708 4709 buf = dpp_build_conf_start(auth, conf, 1000); 4710 if (!buf) 4711 return NULL; 4712 4713 wpabuf_printf(buf, "\"cred\":{\"akm\":\"%s\",", dpp_akm_str(conf->akm)); 4714 dpp_build_legacy_cred_params(buf, conf); 4715 wpabuf_put_str(buf, "}}"); 4716 4717 wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Configuration Object (legacy)", 4718 wpabuf_head(buf), wpabuf_len(buf)); 4719 4720 return buf; 4721 } 4722 4723 4724 static struct wpabuf * 4725 dpp_build_conf_obj(struct dpp_authentication *auth, int ap) 4726 { 4727 struct dpp_configuration *conf; 4728 4729 #ifdef CONFIG_TESTING_OPTIONS 4730 if (auth->config_obj_override) { 4731 wpa_printf(MSG_DEBUG, "DPP: Testing - Config Object override"); 4732 return wpabuf_alloc_copy(auth->config_obj_override, 4733 os_strlen(auth->config_obj_override)); 4734 } 4735 #endif /* CONFIG_TESTING_OPTIONS */ 4736 4737 conf = ap ? auth->conf_ap : auth->conf_sta; 4738 if (!conf) { 4739 wpa_printf(MSG_DEBUG, 4740 "DPP: No configuration available for Enrollee(%s) - reject configuration request", 4741 ap ? "ap" : "sta"); 4742 return NULL; 4743 } 4744 4745 if (dpp_akm_dpp(conf->akm)) 4746 return dpp_build_conf_obj_dpp(auth, ap, conf); 4747 return dpp_build_conf_obj_legacy(auth, ap, conf); 4748 } 4749 4750 4751 static struct wpabuf * 4752 dpp_build_conf_resp(struct dpp_authentication *auth, const u8 *e_nonce, 4753 u16 e_nonce_len, int ap) 4754 { 4755 struct wpabuf *conf; 4756 size_t clear_len, attr_len; 4757 struct wpabuf *clear = NULL, *msg = NULL; 4758 u8 *wrapped; 4759 const u8 *addr[1]; 4760 size_t len[1]; 4761 enum dpp_status_error status; 4762 4763 conf = dpp_build_conf_obj(auth, ap); 4764 if (conf) { 4765 wpa_hexdump_ascii(MSG_DEBUG, "DPP: configurationObject JSON", 4766 wpabuf_head(conf), wpabuf_len(conf)); 4767 } 4768 status = conf ? DPP_STATUS_OK : DPP_STATUS_CONFIGURE_FAILURE; 4769 auth->conf_resp_status = status; 4770 4771 /* { E-nonce, configurationObject}ke */ 4772 clear_len = 4 + e_nonce_len; 4773 if (conf) 4774 clear_len += 4 + wpabuf_len(conf); 4775 clear = wpabuf_alloc(clear_len); 4776 attr_len = 4 + 1 + 4 + clear_len + AES_BLOCK_SIZE; 4777 #ifdef CONFIG_TESTING_OPTIONS 4778 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP) 4779 attr_len += 5; 4780 #endif /* CONFIG_TESTING_OPTIONS */ 4781 msg = wpabuf_alloc(attr_len); 4782 if (!clear || !msg) 4783 goto fail; 4784 4785 #ifdef CONFIG_TESTING_OPTIONS 4786 if (dpp_test == DPP_TEST_NO_E_NONCE_CONF_RESP) { 4787 wpa_printf(MSG_INFO, "DPP: TESTING - no E-nonce"); 4788 goto skip_e_nonce; 4789 } 4790 if (dpp_test == DPP_TEST_E_NONCE_MISMATCH_CONF_RESP) { 4791 wpa_printf(MSG_INFO, "DPP: TESTING - E-nonce mismatch"); 4792 wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); 4793 wpabuf_put_le16(clear, e_nonce_len); 4794 wpabuf_put_data(clear, e_nonce, e_nonce_len - 1); 4795 wpabuf_put_u8(clear, e_nonce[e_nonce_len - 1] ^ 0x01); 4796 goto skip_e_nonce; 4797 } 4798 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_CONF_RESP) { 4799 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 4800 goto skip_wrapped_data; 4801 } 4802 #endif /* CONFIG_TESTING_OPTIONS */ 4803 4804 /* E-nonce */ 4805 wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); 4806 wpabuf_put_le16(clear, e_nonce_len); 4807 wpabuf_put_data(clear, e_nonce, e_nonce_len); 4808 4809 #ifdef CONFIG_TESTING_OPTIONS 4810 skip_e_nonce: 4811 if (dpp_test == DPP_TEST_NO_CONFIG_OBJ_CONF_RESP) { 4812 wpa_printf(MSG_INFO, "DPP: TESTING - Config Object"); 4813 goto skip_config_obj; 4814 } 4815 #endif /* CONFIG_TESTING_OPTIONS */ 4816 4817 if (conf) { 4818 wpabuf_put_le16(clear, DPP_ATTR_CONFIG_OBJ); 4819 wpabuf_put_le16(clear, wpabuf_len(conf)); 4820 wpabuf_put_buf(clear, conf); 4821 } 4822 4823 #ifdef CONFIG_TESTING_OPTIONS 4824 skip_config_obj: 4825 if (dpp_test == DPP_TEST_NO_STATUS_CONF_RESP) { 4826 wpa_printf(MSG_INFO, "DPP: TESTING - Status"); 4827 goto skip_status; 4828 } 4829 if (dpp_test == DPP_TEST_INVALID_STATUS_CONF_RESP) { 4830 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); 4831 status = 255; 4832 } 4833 #endif /* CONFIG_TESTING_OPTIONS */ 4834 4835 /* DPP Status */ 4836 dpp_build_attr_status(msg, status); 4837 4838 #ifdef CONFIG_TESTING_OPTIONS 4839 skip_status: 4840 #endif /* CONFIG_TESTING_OPTIONS */ 4841 4842 addr[0] = wpabuf_head(msg); 4843 len[0] = wpabuf_len(msg); 4844 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD", addr[0], len[0]); 4845 4846 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 4847 wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 4848 wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 4849 4850 wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); 4851 if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, 4852 wpabuf_head(clear), wpabuf_len(clear), 4853 1, addr, len, wrapped) < 0) 4854 goto fail; 4855 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 4856 wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); 4857 4858 #ifdef CONFIG_TESTING_OPTIONS 4859 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_CONF_RESP) { 4860 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 4861 dpp_build_attr_status(msg, DPP_STATUS_OK); 4862 } 4863 skip_wrapped_data: 4864 #endif /* CONFIG_TESTING_OPTIONS */ 4865 4866 wpa_hexdump_buf(MSG_DEBUG, 4867 "DPP: Configuration Response attributes", msg); 4868 out: 4869 wpabuf_free(conf); 4870 wpabuf_free(clear); 4871 4872 return msg; 4873 fail: 4874 wpabuf_free(msg); 4875 msg = NULL; 4876 goto out; 4877 } 4878 4879 4880 struct wpabuf * 4881 dpp_conf_req_rx(struct dpp_authentication *auth, const u8 *attr_start, 4882 size_t attr_len) 4883 { 4884 const u8 *wrapped_data, *e_nonce, *config_attr; 4885 u16 wrapped_data_len, e_nonce_len, config_attr_len; 4886 u8 *unwrapped = NULL; 4887 size_t unwrapped_len = 0; 4888 struct wpabuf *resp = NULL; 4889 struct json_token *root = NULL, *token; 4890 int ap; 4891 4892 #ifdef CONFIG_TESTING_OPTIONS 4893 if (dpp_test == DPP_TEST_STOP_AT_CONF_REQ) { 4894 wpa_printf(MSG_INFO, 4895 "DPP: TESTING - stop at Config Request"); 4896 return NULL; 4897 } 4898 #endif /* CONFIG_TESTING_OPTIONS */ 4899 4900 if (dpp_check_attrs(attr_start, attr_len) < 0) { 4901 dpp_auth_fail(auth, "Invalid attribute in config request"); 4902 return NULL; 4903 } 4904 4905 wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, 4906 &wrapped_data_len); 4907 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 4908 dpp_auth_fail(auth, 4909 "Missing or invalid required Wrapped Data attribute"); 4910 return NULL; 4911 } 4912 4913 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 4914 wrapped_data, wrapped_data_len); 4915 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 4916 unwrapped = os_malloc(unwrapped_len); 4917 if (!unwrapped) 4918 return NULL; 4919 if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, 4920 wrapped_data, wrapped_data_len, 4921 0, NULL, NULL, unwrapped) < 0) { 4922 dpp_auth_fail(auth, "AES-SIV decryption failed"); 4923 goto fail; 4924 } 4925 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 4926 unwrapped, unwrapped_len); 4927 4928 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 4929 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 4930 goto fail; 4931 } 4932 4933 e_nonce = dpp_get_attr(unwrapped, unwrapped_len, 4934 DPP_ATTR_ENROLLEE_NONCE, 4935 &e_nonce_len); 4936 if (!e_nonce || e_nonce_len != auth->curve->nonce_len) { 4937 dpp_auth_fail(auth, 4938 "Missing or invalid Enrollee Nonce attribute"); 4939 goto fail; 4940 } 4941 wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len); 4942 os_memcpy(auth->e_nonce, e_nonce, e_nonce_len); 4943 4944 config_attr = dpp_get_attr(unwrapped, unwrapped_len, 4945 DPP_ATTR_CONFIG_ATTR_OBJ, 4946 &config_attr_len); 4947 if (!config_attr) { 4948 dpp_auth_fail(auth, 4949 "Missing or invalid Config Attributes attribute"); 4950 goto fail; 4951 } 4952 wpa_hexdump_ascii(MSG_DEBUG, "DPP: Config Attributes", 4953 config_attr, config_attr_len); 4954 4955 root = json_parse((const char *) config_attr, config_attr_len); 4956 if (!root) { 4957 dpp_auth_fail(auth, "Could not parse Config Attributes"); 4958 goto fail; 4959 } 4960 4961 token = json_get_member(root, "name"); 4962 if (!token || token->type != JSON_STRING) { 4963 dpp_auth_fail(auth, "No Config Attributes - name"); 4964 goto fail; 4965 } 4966 wpa_printf(MSG_DEBUG, "DPP: Enrollee name = '%s'", token->string); 4967 4968 token = json_get_member(root, "wi-fi_tech"); 4969 if (!token || token->type != JSON_STRING) { 4970 dpp_auth_fail(auth, "No Config Attributes - wi-fi_tech"); 4971 goto fail; 4972 } 4973 wpa_printf(MSG_DEBUG, "DPP: wi-fi_tech = '%s'", token->string); 4974 if (os_strcmp(token->string, "infra") != 0) { 4975 wpa_printf(MSG_DEBUG, "DPP: Unsupported wi-fi_tech '%s'", 4976 token->string); 4977 dpp_auth_fail(auth, "Unsupported wi-fi_tech"); 4978 goto fail; 4979 } 4980 4981 token = json_get_member(root, "netRole"); 4982 if (!token || token->type != JSON_STRING) { 4983 dpp_auth_fail(auth, "No Config Attributes - netRole"); 4984 goto fail; 4985 } 4986 wpa_printf(MSG_DEBUG, "DPP: netRole = '%s'", token->string); 4987 if (os_strcmp(token->string, "sta") == 0) { 4988 ap = 0; 4989 } else if (os_strcmp(token->string, "ap") == 0) { 4990 ap = 1; 4991 } else { 4992 wpa_printf(MSG_DEBUG, "DPP: Unsupported netRole '%s'", 4993 token->string); 4994 dpp_auth_fail(auth, "Unsupported netRole"); 4995 goto fail; 4996 } 4997 4998 resp = dpp_build_conf_resp(auth, e_nonce, e_nonce_len, ap); 4999 5000 fail: 5001 json_free(root); 5002 os_free(unwrapped); 5003 return resp; 5004 } 5005 5006 5007 static struct wpabuf * 5008 dpp_parse_jws_prot_hdr(const struct dpp_curve_params *curve, 5009 const u8 *prot_hdr, u16 prot_hdr_len, 5010 const EVP_MD **ret_md) 5011 { 5012 struct json_token *root, *token; 5013 struct wpabuf *kid = NULL; 5014 5015 root = json_parse((const char *) prot_hdr, prot_hdr_len); 5016 if (!root) { 5017 wpa_printf(MSG_DEBUG, 5018 "DPP: JSON parsing failed for JWS Protected Header"); 5019 goto fail; 5020 } 5021 5022 if (root->type != JSON_OBJECT) { 5023 wpa_printf(MSG_DEBUG, 5024 "DPP: JWS Protected Header root is not an object"); 5025 goto fail; 5026 } 5027 5028 token = json_get_member(root, "typ"); 5029 if (!token || token->type != JSON_STRING) { 5030 wpa_printf(MSG_DEBUG, "DPP: No typ string value found"); 5031 goto fail; 5032 } 5033 wpa_printf(MSG_DEBUG, "DPP: JWS Protected Header typ=%s", 5034 token->string); 5035 if (os_strcmp(token->string, "dppCon") != 0) { 5036 wpa_printf(MSG_DEBUG, 5037 "DPP: Unsupported JWS Protected Header typ=%s", 5038 token->string); 5039 goto fail; 5040 } 5041 5042 token = json_get_member(root, "alg"); 5043 if (!token || token->type != JSON_STRING) { 5044 wpa_printf(MSG_DEBUG, "DPP: No alg string value found"); 5045 goto fail; 5046 } 5047 wpa_printf(MSG_DEBUG, "DPP: JWS Protected Header alg=%s", 5048 token->string); 5049 if (os_strcmp(token->string, curve->jws_alg) != 0) { 5050 wpa_printf(MSG_DEBUG, 5051 "DPP: Unexpected JWS Protected Header alg=%s (expected %s based on C-sign-key)", 5052 token->string, curve->jws_alg); 5053 goto fail; 5054 } 5055 if (os_strcmp(token->string, "ES256") == 0 || 5056 os_strcmp(token->string, "BS256") == 0) 5057 *ret_md = EVP_sha256(); 5058 else if (os_strcmp(token->string, "ES384") == 0 || 5059 os_strcmp(token->string, "BS384") == 0) 5060 *ret_md = EVP_sha384(); 5061 else if (os_strcmp(token->string, "ES512") == 0 || 5062 os_strcmp(token->string, "BS512") == 0) 5063 *ret_md = EVP_sha512(); 5064 else 5065 *ret_md = NULL; 5066 if (!*ret_md) { 5067 wpa_printf(MSG_DEBUG, 5068 "DPP: Unsupported JWS Protected Header alg=%s", 5069 token->string); 5070 goto fail; 5071 } 5072 5073 kid = json_get_member_base64url(root, "kid"); 5074 if (!kid) { 5075 wpa_printf(MSG_DEBUG, "DPP: No kid string value found"); 5076 goto fail; 5077 } 5078 wpa_hexdump_buf(MSG_DEBUG, "DPP: JWS Protected Header kid (decoded)", 5079 kid); 5080 5081 fail: 5082 json_free(root); 5083 return kid; 5084 } 5085 5086 5087 static int dpp_parse_cred_legacy(struct dpp_authentication *auth, 5088 struct json_token *cred) 5089 { 5090 struct json_token *pass, *psk_hex; 5091 5092 wpa_printf(MSG_DEBUG, "DPP: Legacy akm=psk credential"); 5093 5094 pass = json_get_member(cred, "pass"); 5095 psk_hex = json_get_member(cred, "psk_hex"); 5096 5097 if (pass && pass->type == JSON_STRING) { 5098 size_t len = os_strlen(pass->string); 5099 5100 wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: Legacy passphrase", 5101 pass->string, len); 5102 if (len < 8 || len > 63) 5103 return -1; 5104 os_strlcpy(auth->passphrase, pass->string, 5105 sizeof(auth->passphrase)); 5106 } else if (psk_hex && psk_hex->type == JSON_STRING) { 5107 if (dpp_akm_sae(auth->akm) && !dpp_akm_psk(auth->akm)) { 5108 wpa_printf(MSG_DEBUG, 5109 "DPP: Unexpected psk_hex with akm=sae"); 5110 return -1; 5111 } 5112 if (os_strlen(psk_hex->string) != PMK_LEN * 2 || 5113 hexstr2bin(psk_hex->string, auth->psk, PMK_LEN) < 0) { 5114 wpa_printf(MSG_DEBUG, "DPP: Invalid psk_hex encoding"); 5115 return -1; 5116 } 5117 wpa_hexdump_key(MSG_DEBUG, "DPP: Legacy PSK", 5118 auth->psk, PMK_LEN); 5119 auth->psk_set = 1; 5120 } else { 5121 wpa_printf(MSG_DEBUG, "DPP: No pass or psk_hex strings found"); 5122 return -1; 5123 } 5124 5125 if (dpp_akm_sae(auth->akm) && !auth->passphrase[0]) { 5126 wpa_printf(MSG_DEBUG, "DPP: No pass for sae found"); 5127 return -1; 5128 } 5129 5130 return 0; 5131 } 5132 5133 5134 static EVP_PKEY * dpp_parse_jwk(struct json_token *jwk, 5135 const struct dpp_curve_params **key_curve) 5136 { 5137 struct json_token *token; 5138 const struct dpp_curve_params *curve; 5139 struct wpabuf *x = NULL, *y = NULL; 5140 EC_GROUP *group; 5141 EVP_PKEY *pkey = NULL; 5142 5143 token = json_get_member(jwk, "kty"); 5144 if (!token || token->type != JSON_STRING) { 5145 wpa_printf(MSG_DEBUG, "DPP: No kty in JWK"); 5146 goto fail; 5147 } 5148 if (os_strcmp(token->string, "EC") != 0) { 5149 wpa_printf(MSG_DEBUG, "DPP: Unexpected JWK kty '%s'", 5150 token->string); 5151 goto fail; 5152 } 5153 5154 token = json_get_member(jwk, "crv"); 5155 if (!token || token->type != JSON_STRING) { 5156 wpa_printf(MSG_DEBUG, "DPP: No crv in JWK"); 5157 goto fail; 5158 } 5159 curve = dpp_get_curve_jwk_crv(token->string); 5160 if (!curve) { 5161 wpa_printf(MSG_DEBUG, "DPP: Unsupported JWK crv '%s'", 5162 token->string); 5163 goto fail; 5164 } 5165 5166 x = json_get_member_base64url(jwk, "x"); 5167 if (!x) { 5168 wpa_printf(MSG_DEBUG, "DPP: No x in JWK"); 5169 goto fail; 5170 } 5171 wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK x", x); 5172 if (wpabuf_len(x) != curve->prime_len) { 5173 wpa_printf(MSG_DEBUG, 5174 "DPP: Unexpected JWK x length %u (expected %u for curve %s)", 5175 (unsigned int) wpabuf_len(x), 5176 (unsigned int) curve->prime_len, curve->name); 5177 goto fail; 5178 } 5179 5180 y = json_get_member_base64url(jwk, "y"); 5181 if (!y) { 5182 wpa_printf(MSG_DEBUG, "DPP: No y in JWK"); 5183 goto fail; 5184 } 5185 wpa_hexdump_buf(MSG_DEBUG, "DPP: JWK y", y); 5186 if (wpabuf_len(y) != curve->prime_len) { 5187 wpa_printf(MSG_DEBUG, 5188 "DPP: Unexpected JWK y length %u (expected %u for curve %s)", 5189 (unsigned int) wpabuf_len(y), 5190 (unsigned int) curve->prime_len, curve->name); 5191 goto fail; 5192 } 5193 5194 group = EC_GROUP_new_by_curve_name(OBJ_txt2nid(curve->name)); 5195 if (!group) { 5196 wpa_printf(MSG_DEBUG, "DPP: Could not prepare group for JWK"); 5197 goto fail; 5198 } 5199 5200 pkey = dpp_set_pubkey_point_group(group, wpabuf_head(x), wpabuf_head(y), 5201 wpabuf_len(x)); 5202 *key_curve = curve; 5203 5204 fail: 5205 wpabuf_free(x); 5206 wpabuf_free(y); 5207 5208 return pkey; 5209 } 5210 5211 5212 int dpp_key_expired(const char *timestamp, os_time_t *expiry) 5213 { 5214 struct os_time now; 5215 unsigned int year, month, day, hour, min, sec; 5216 os_time_t utime; 5217 const char *pos; 5218 5219 /* ISO 8601 date and time: 5220 * <date>T<time> 5221 * YYYY-MM-DDTHH:MM:SSZ 5222 * YYYY-MM-DDTHH:MM:SS+03:00 5223 */ 5224 if (os_strlen(timestamp) < 19) { 5225 wpa_printf(MSG_DEBUG, 5226 "DPP: Too short timestamp - assume expired key"); 5227 return 1; 5228 } 5229 if (sscanf(timestamp, "%04u-%02u-%02uT%02u:%02u:%02u", 5230 &year, &month, &day, &hour, &min, &sec) != 6) { 5231 wpa_printf(MSG_DEBUG, 5232 "DPP: Failed to parse expiration day - assume expired key"); 5233 return 1; 5234 } 5235 5236 if (os_mktime(year, month, day, hour, min, sec, &utime) < 0) { 5237 wpa_printf(MSG_DEBUG, 5238 "DPP: Invalid date/time information - assume expired key"); 5239 return 1; 5240 } 5241 5242 pos = timestamp + 19; 5243 if (*pos == 'Z' || *pos == '\0') { 5244 /* In UTC - no need to adjust */ 5245 } else if (*pos == '-' || *pos == '+') { 5246 int items; 5247 5248 /* Adjust local time to UTC */ 5249 items = sscanf(pos + 1, "%02u:%02u", &hour, &min); 5250 if (items < 1) { 5251 wpa_printf(MSG_DEBUG, 5252 "DPP: Invalid time zone designator (%s) - assume expired key", 5253 pos); 5254 return 1; 5255 } 5256 if (*pos == '-') 5257 utime += 3600 * hour; 5258 if (*pos == '+') 5259 utime -= 3600 * hour; 5260 if (items > 1) { 5261 if (*pos == '-') 5262 utime += 60 * min; 5263 if (*pos == '+') 5264 utime -= 60 * min; 5265 } 5266 } else { 5267 wpa_printf(MSG_DEBUG, 5268 "DPP: Invalid time zone designator (%s) - assume expired key", 5269 pos); 5270 return 1; 5271 } 5272 if (expiry) 5273 *expiry = utime; 5274 5275 if (os_get_time(&now) < 0) { 5276 wpa_printf(MSG_DEBUG, 5277 "DPP: Cannot get current time - assume expired key"); 5278 return 1; 5279 } 5280 5281 if (now.sec > utime) { 5282 wpa_printf(MSG_DEBUG, "DPP: Key has expired (%lu < %lu)", 5283 utime, now.sec); 5284 return 1; 5285 } 5286 5287 return 0; 5288 } 5289 5290 5291 static int dpp_parse_connector(struct dpp_authentication *auth, 5292 const unsigned char *payload, 5293 u16 payload_len) 5294 { 5295 struct json_token *root, *groups, *netkey, *token; 5296 int ret = -1; 5297 EVP_PKEY *key = NULL; 5298 const struct dpp_curve_params *curve; 5299 unsigned int rules = 0; 5300 5301 root = json_parse((const char *) payload, payload_len); 5302 if (!root) { 5303 wpa_printf(MSG_DEBUG, "DPP: JSON parsing of connector failed"); 5304 goto fail; 5305 } 5306 5307 groups = json_get_member(root, "groups"); 5308 if (!groups || groups->type != JSON_ARRAY) { 5309 wpa_printf(MSG_DEBUG, "DPP: No groups array found"); 5310 goto skip_groups; 5311 } 5312 for (token = groups->child; token; token = token->sibling) { 5313 struct json_token *id, *role; 5314 5315 id = json_get_member(token, "groupId"); 5316 if (!id || id->type != JSON_STRING) { 5317 wpa_printf(MSG_DEBUG, "DPP: Missing groupId string"); 5318 goto fail; 5319 } 5320 5321 role = json_get_member(token, "netRole"); 5322 if (!role || role->type != JSON_STRING) { 5323 wpa_printf(MSG_DEBUG, "DPP: Missing netRole string"); 5324 goto fail; 5325 } 5326 wpa_printf(MSG_DEBUG, 5327 "DPP: connector group: groupId='%s' netRole='%s'", 5328 id->string, role->string); 5329 rules++; 5330 } 5331 skip_groups: 5332 5333 if (!rules) { 5334 wpa_printf(MSG_DEBUG, 5335 "DPP: Connector includes no groups"); 5336 goto fail; 5337 } 5338 5339 token = json_get_member(root, "expiry"); 5340 if (!token || token->type != JSON_STRING) { 5341 wpa_printf(MSG_DEBUG, 5342 "DPP: No expiry string found - connector does not expire"); 5343 } else { 5344 wpa_printf(MSG_DEBUG, "DPP: expiry = %s", token->string); 5345 if (dpp_key_expired(token->string, 5346 &auth->net_access_key_expiry)) { 5347 wpa_printf(MSG_DEBUG, 5348 "DPP: Connector (netAccessKey) has expired"); 5349 goto fail; 5350 } 5351 } 5352 5353 netkey = json_get_member(root, "netAccessKey"); 5354 if (!netkey || netkey->type != JSON_OBJECT) { 5355 wpa_printf(MSG_DEBUG, "DPP: No netAccessKey object found"); 5356 goto fail; 5357 } 5358 5359 key = dpp_parse_jwk(netkey, &curve); 5360 if (!key) 5361 goto fail; 5362 dpp_debug_print_key("DPP: Received netAccessKey", key); 5363 5364 if (EVP_PKEY_cmp(key, auth->own_protocol_key) != 1) { 5365 wpa_printf(MSG_DEBUG, 5366 "DPP: netAccessKey in connector does not match own protocol key"); 5367 #ifdef CONFIG_TESTING_OPTIONS 5368 if (auth->ignore_netaccesskey_mismatch) { 5369 wpa_printf(MSG_DEBUG, 5370 "DPP: TESTING - skip netAccessKey mismatch"); 5371 } else { 5372 goto fail; 5373 } 5374 #else /* CONFIG_TESTING_OPTIONS */ 5375 goto fail; 5376 #endif /* CONFIG_TESTING_OPTIONS */ 5377 } 5378 5379 ret = 0; 5380 fail: 5381 EVP_PKEY_free(key); 5382 json_free(root); 5383 return ret; 5384 } 5385 5386 5387 static int dpp_check_pubkey_match(EVP_PKEY *pub, struct wpabuf *r_hash) 5388 { 5389 struct wpabuf *uncomp; 5390 int res; 5391 u8 hash[SHA256_MAC_LEN]; 5392 const u8 *addr[1]; 5393 size_t len[1]; 5394 5395 if (wpabuf_len(r_hash) != SHA256_MAC_LEN) 5396 return -1; 5397 uncomp = dpp_get_pubkey_point(pub, 1); 5398 if (!uncomp) 5399 return -1; 5400 addr[0] = wpabuf_head(uncomp); 5401 len[0] = wpabuf_len(uncomp); 5402 wpa_hexdump(MSG_DEBUG, "DPP: Uncompressed public key", 5403 addr[0], len[0]); 5404 res = sha256_vector(1, addr, len, hash); 5405 wpabuf_free(uncomp); 5406 if (res < 0) 5407 return -1; 5408 if (os_memcmp(hash, wpabuf_head(r_hash), SHA256_MAC_LEN) != 0) { 5409 wpa_printf(MSG_DEBUG, 5410 "DPP: Received hash value does not match calculated public key hash value"); 5411 wpa_hexdump(MSG_DEBUG, "DPP: Calculated hash", 5412 hash, SHA256_MAC_LEN); 5413 return -1; 5414 } 5415 return 0; 5416 } 5417 5418 5419 static void dpp_copy_csign(struct dpp_authentication *auth, EVP_PKEY *csign) 5420 { 5421 unsigned char *der = NULL; 5422 int der_len; 5423 5424 der_len = i2d_PUBKEY(csign, &der); 5425 if (der_len <= 0) 5426 return; 5427 wpabuf_free(auth->c_sign_key); 5428 auth->c_sign_key = wpabuf_alloc_copy(der, der_len); 5429 OPENSSL_free(der); 5430 } 5431 5432 5433 static void dpp_copy_netaccesskey(struct dpp_authentication *auth) 5434 { 5435 unsigned char *der = NULL; 5436 int der_len; 5437 EC_KEY *eckey; 5438 5439 eckey = EVP_PKEY_get1_EC_KEY(auth->own_protocol_key); 5440 if (!eckey) 5441 return; 5442 5443 der_len = i2d_ECPrivateKey(eckey, &der); 5444 if (der_len <= 0) { 5445 EC_KEY_free(eckey); 5446 return; 5447 } 5448 wpabuf_free(auth->net_access_key); 5449 auth->net_access_key = wpabuf_alloc_copy(der, der_len); 5450 OPENSSL_free(der); 5451 EC_KEY_free(eckey); 5452 } 5453 5454 5455 struct dpp_signed_connector_info { 5456 unsigned char *payload; 5457 size_t payload_len; 5458 }; 5459 5460 static enum dpp_status_error 5461 dpp_process_signed_connector(struct dpp_signed_connector_info *info, 5462 EVP_PKEY *csign_pub, const char *connector) 5463 { 5464 enum dpp_status_error ret = 255; 5465 const char *pos, *end, *signed_start, *signed_end; 5466 struct wpabuf *kid = NULL; 5467 unsigned char *prot_hdr = NULL, *signature = NULL; 5468 size_t prot_hdr_len = 0, signature_len = 0; 5469 const EVP_MD *sign_md = NULL; 5470 unsigned char *der = NULL; 5471 int der_len; 5472 int res; 5473 EVP_MD_CTX *md_ctx = NULL; 5474 ECDSA_SIG *sig = NULL; 5475 BIGNUM *r = NULL, *s = NULL; 5476 const struct dpp_curve_params *curve; 5477 EC_KEY *eckey; 5478 const EC_GROUP *group; 5479 int nid; 5480 5481 eckey = EVP_PKEY_get1_EC_KEY(csign_pub); 5482 if (!eckey) 5483 goto fail; 5484 group = EC_KEY_get0_group(eckey); 5485 if (!group) 5486 goto fail; 5487 nid = EC_GROUP_get_curve_name(group); 5488 curve = dpp_get_curve_nid(nid); 5489 if (!curve) 5490 goto fail; 5491 wpa_printf(MSG_DEBUG, "DPP: C-sign-key group: %s", curve->jwk_crv); 5492 os_memset(info, 0, sizeof(*info)); 5493 5494 signed_start = pos = connector; 5495 end = os_strchr(pos, '.'); 5496 if (!end) { 5497 wpa_printf(MSG_DEBUG, "DPP: Missing dot(1) in signedConnector"); 5498 ret = DPP_STATUS_INVALID_CONNECTOR; 5499 goto fail; 5500 } 5501 prot_hdr = base64_url_decode((const unsigned char *) pos, 5502 end - pos, &prot_hdr_len); 5503 if (!prot_hdr) { 5504 wpa_printf(MSG_DEBUG, 5505 "DPP: Failed to base64url decode signedConnector JWS Protected Header"); 5506 ret = DPP_STATUS_INVALID_CONNECTOR; 5507 goto fail; 5508 } 5509 wpa_hexdump_ascii(MSG_DEBUG, 5510 "DPP: signedConnector - JWS Protected Header", 5511 prot_hdr, prot_hdr_len); 5512 kid = dpp_parse_jws_prot_hdr(curve, prot_hdr, prot_hdr_len, &sign_md); 5513 if (!kid) { 5514 ret = DPP_STATUS_INVALID_CONNECTOR; 5515 goto fail; 5516 } 5517 if (wpabuf_len(kid) != SHA256_MAC_LEN) { 5518 wpa_printf(MSG_DEBUG, 5519 "DPP: Unexpected signedConnector JWS Protected Header kid length: %u (expected %u)", 5520 (unsigned int) wpabuf_len(kid), SHA256_MAC_LEN); 5521 ret = DPP_STATUS_INVALID_CONNECTOR; 5522 goto fail; 5523 } 5524 5525 pos = end + 1; 5526 end = os_strchr(pos, '.'); 5527 if (!end) { 5528 wpa_printf(MSG_DEBUG, 5529 "DPP: Missing dot(2) in signedConnector"); 5530 ret = DPP_STATUS_INVALID_CONNECTOR; 5531 goto fail; 5532 } 5533 signed_end = end - 1; 5534 info->payload = base64_url_decode((const unsigned char *) pos, 5535 end - pos, &info->payload_len); 5536 if (!info->payload) { 5537 wpa_printf(MSG_DEBUG, 5538 "DPP: Failed to base64url decode signedConnector JWS Payload"); 5539 ret = DPP_STATUS_INVALID_CONNECTOR; 5540 goto fail; 5541 } 5542 wpa_hexdump_ascii(MSG_DEBUG, 5543 "DPP: signedConnector - JWS Payload", 5544 info->payload, info->payload_len); 5545 pos = end + 1; 5546 signature = base64_url_decode((const unsigned char *) pos, 5547 os_strlen(pos), &signature_len); 5548 if (!signature) { 5549 wpa_printf(MSG_DEBUG, 5550 "DPP: Failed to base64url decode signedConnector signature"); 5551 ret = DPP_STATUS_INVALID_CONNECTOR; 5552 goto fail; 5553 } 5554 wpa_hexdump(MSG_DEBUG, "DPP: signedConnector - signature", 5555 signature, signature_len); 5556 5557 if (dpp_check_pubkey_match(csign_pub, kid) < 0) { 5558 ret = DPP_STATUS_NO_MATCH; 5559 goto fail; 5560 } 5561 5562 if (signature_len & 0x01) { 5563 wpa_printf(MSG_DEBUG, 5564 "DPP: Unexpected signedConnector signature length (%d)", 5565 (int) signature_len); 5566 ret = DPP_STATUS_INVALID_CONNECTOR; 5567 goto fail; 5568 } 5569 5570 /* JWS Signature encodes the signature (r,s) as two octet strings. Need 5571 * to convert that to DER encoded ECDSA_SIG for OpenSSL EVP routines. */ 5572 r = BN_bin2bn(signature, signature_len / 2, NULL); 5573 s = BN_bin2bn(signature + signature_len / 2, signature_len / 2, NULL); 5574 sig = ECDSA_SIG_new(); 5575 if (!r || !s || !sig || ECDSA_SIG_set0(sig, r, s) != 1) 5576 goto fail; 5577 r = NULL; 5578 s = NULL; 5579 5580 der_len = i2d_ECDSA_SIG(sig, &der); 5581 if (der_len <= 0) { 5582 wpa_printf(MSG_DEBUG, "DPP: Could not DER encode signature"); 5583 goto fail; 5584 } 5585 wpa_hexdump(MSG_DEBUG, "DPP: DER encoded signature", der, der_len); 5586 md_ctx = EVP_MD_CTX_create(); 5587 if (!md_ctx) 5588 goto fail; 5589 5590 ERR_clear_error(); 5591 if (EVP_DigestVerifyInit(md_ctx, NULL, sign_md, NULL, csign_pub) != 1) { 5592 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestVerifyInit failed: %s", 5593 ERR_error_string(ERR_get_error(), NULL)); 5594 goto fail; 5595 } 5596 if (EVP_DigestVerifyUpdate(md_ctx, signed_start, 5597 signed_end - signed_start + 1) != 1) { 5598 wpa_printf(MSG_DEBUG, "DPP: EVP_DigestVerifyUpdate failed: %s", 5599 ERR_error_string(ERR_get_error(), NULL)); 5600 goto fail; 5601 } 5602 res = EVP_DigestVerifyFinal(md_ctx, der, der_len); 5603 if (res != 1) { 5604 wpa_printf(MSG_DEBUG, 5605 "DPP: EVP_DigestVerifyFinal failed (res=%d): %s", 5606 res, ERR_error_string(ERR_get_error(), NULL)); 5607 ret = DPP_STATUS_INVALID_CONNECTOR; 5608 goto fail; 5609 } 5610 5611 ret = DPP_STATUS_OK; 5612 fail: 5613 EC_KEY_free(eckey); 5614 EVP_MD_CTX_destroy(md_ctx); 5615 os_free(prot_hdr); 5616 wpabuf_free(kid); 5617 os_free(signature); 5618 ECDSA_SIG_free(sig); 5619 BN_free(r); 5620 BN_free(s); 5621 OPENSSL_free(der); 5622 return ret; 5623 } 5624 5625 5626 static int dpp_parse_cred_dpp(struct dpp_authentication *auth, 5627 struct json_token *cred) 5628 { 5629 struct dpp_signed_connector_info info; 5630 struct json_token *token, *csign; 5631 int ret = -1; 5632 EVP_PKEY *csign_pub = NULL; 5633 const struct dpp_curve_params *key_curve = NULL; 5634 const char *signed_connector; 5635 5636 os_memset(&info, 0, sizeof(info)); 5637 5638 if (dpp_akm_psk(auth->akm) || dpp_akm_sae(auth->akm)) { 5639 wpa_printf(MSG_DEBUG, 5640 "DPP: Legacy credential included in Connector credential"); 5641 if (dpp_parse_cred_legacy(auth, cred) < 0) 5642 return -1; 5643 } 5644 5645 wpa_printf(MSG_DEBUG, "DPP: Connector credential"); 5646 5647 csign = json_get_member(cred, "csign"); 5648 if (!csign || csign->type != JSON_OBJECT) { 5649 wpa_printf(MSG_DEBUG, "DPP: No csign JWK in JSON"); 5650 goto fail; 5651 } 5652 5653 csign_pub = dpp_parse_jwk(csign, &key_curve); 5654 if (!csign_pub) { 5655 wpa_printf(MSG_DEBUG, "DPP: Failed to parse csign JWK"); 5656 goto fail; 5657 } 5658 dpp_debug_print_key("DPP: Received C-sign-key", csign_pub); 5659 5660 token = json_get_member(cred, "signedConnector"); 5661 if (!token || token->type != JSON_STRING) { 5662 wpa_printf(MSG_DEBUG, "DPP: No signedConnector string found"); 5663 goto fail; 5664 } 5665 wpa_hexdump_ascii(MSG_DEBUG, "DPP: signedConnector", 5666 token->string, os_strlen(token->string)); 5667 signed_connector = token->string; 5668 5669 if (os_strchr(signed_connector, '"') || 5670 os_strchr(signed_connector, '\n')) { 5671 wpa_printf(MSG_DEBUG, 5672 "DPP: Unexpected character in signedConnector"); 5673 goto fail; 5674 } 5675 5676 if (dpp_process_signed_connector(&info, csign_pub, 5677 signed_connector) != DPP_STATUS_OK) 5678 goto fail; 5679 5680 if (dpp_parse_connector(auth, info.payload, info.payload_len) < 0) { 5681 wpa_printf(MSG_DEBUG, "DPP: Failed to parse connector"); 5682 goto fail; 5683 } 5684 5685 os_free(auth->connector); 5686 auth->connector = os_strdup(signed_connector); 5687 5688 dpp_copy_csign(auth, csign_pub); 5689 dpp_copy_netaccesskey(auth); 5690 5691 ret = 0; 5692 fail: 5693 EVP_PKEY_free(csign_pub); 5694 os_free(info.payload); 5695 return ret; 5696 } 5697 5698 5699 const char * dpp_akm_str(enum dpp_akm akm) 5700 { 5701 switch (akm) { 5702 case DPP_AKM_DPP: 5703 return "dpp"; 5704 case DPP_AKM_PSK: 5705 return "psk"; 5706 case DPP_AKM_SAE: 5707 return "sae"; 5708 case DPP_AKM_PSK_SAE: 5709 return "psk+sae"; 5710 case DPP_AKM_SAE_DPP: 5711 return "dpp+sae"; 5712 case DPP_AKM_PSK_SAE_DPP: 5713 return "dpp+psk+sae"; 5714 default: 5715 return "??"; 5716 } 5717 } 5718 5719 5720 static enum dpp_akm dpp_akm_from_str(const char *akm) 5721 { 5722 if (os_strcmp(akm, "psk") == 0) 5723 return DPP_AKM_PSK; 5724 if (os_strcmp(akm, "sae") == 0) 5725 return DPP_AKM_SAE; 5726 if (os_strcmp(akm, "psk+sae") == 0) 5727 return DPP_AKM_PSK_SAE; 5728 if (os_strcmp(akm, "dpp") == 0) 5729 return DPP_AKM_DPP; 5730 if (os_strcmp(akm, "dpp+sae") == 0) 5731 return DPP_AKM_SAE_DPP; 5732 if (os_strcmp(akm, "dpp+psk+sae") == 0) 5733 return DPP_AKM_PSK_SAE_DPP; 5734 return DPP_AKM_UNKNOWN; 5735 } 5736 5737 5738 static int dpp_parse_conf_obj(struct dpp_authentication *auth, 5739 const u8 *conf_obj, u16 conf_obj_len) 5740 { 5741 int ret = -1; 5742 struct json_token *root, *token, *discovery, *cred; 5743 5744 root = json_parse((const char *) conf_obj, conf_obj_len); 5745 if (!root) 5746 return -1; 5747 if (root->type != JSON_OBJECT) { 5748 dpp_auth_fail(auth, "JSON root is not an object"); 5749 goto fail; 5750 } 5751 5752 token = json_get_member(root, "wi-fi_tech"); 5753 if (!token || token->type != JSON_STRING) { 5754 dpp_auth_fail(auth, "No wi-fi_tech string value found"); 5755 goto fail; 5756 } 5757 if (os_strcmp(token->string, "infra") != 0) { 5758 wpa_printf(MSG_DEBUG, "DPP: Unsupported wi-fi_tech value: '%s'", 5759 token->string); 5760 dpp_auth_fail(auth, "Unsupported wi-fi_tech value"); 5761 goto fail; 5762 } 5763 5764 discovery = json_get_member(root, "discovery"); 5765 if (!discovery || discovery->type != JSON_OBJECT) { 5766 dpp_auth_fail(auth, "No discovery object in JSON"); 5767 goto fail; 5768 } 5769 5770 token = json_get_member(discovery, "ssid"); 5771 if (!token || token->type != JSON_STRING) { 5772 dpp_auth_fail(auth, "No discovery::ssid string value found"); 5773 goto fail; 5774 } 5775 wpa_hexdump_ascii(MSG_DEBUG, "DPP: discovery::ssid", 5776 token->string, os_strlen(token->string)); 5777 if (os_strlen(token->string) > SSID_MAX_LEN) { 5778 dpp_auth_fail(auth, "Too long discovery::ssid string value"); 5779 goto fail; 5780 } 5781 auth->ssid_len = os_strlen(token->string); 5782 os_memcpy(auth->ssid, token->string, auth->ssid_len); 5783 5784 cred = json_get_member(root, "cred"); 5785 if (!cred || cred->type != JSON_OBJECT) { 5786 dpp_auth_fail(auth, "No cred object in JSON"); 5787 goto fail; 5788 } 5789 5790 token = json_get_member(cred, "akm"); 5791 if (!token || token->type != JSON_STRING) { 5792 dpp_auth_fail(auth, "No cred::akm string value found"); 5793 goto fail; 5794 } 5795 auth->akm = dpp_akm_from_str(token->string); 5796 5797 if (dpp_akm_legacy(auth->akm)) { 5798 if (dpp_parse_cred_legacy(auth, cred) < 0) 5799 goto fail; 5800 } else if (dpp_akm_dpp(auth->akm)) { 5801 if (dpp_parse_cred_dpp(auth, cred) < 0) 5802 goto fail; 5803 } else { 5804 wpa_printf(MSG_DEBUG, "DPP: Unsupported akm: %s", 5805 token->string); 5806 dpp_auth_fail(auth, "Unsupported akm"); 5807 goto fail; 5808 } 5809 5810 wpa_printf(MSG_DEBUG, "DPP: JSON parsing completed successfully"); 5811 ret = 0; 5812 fail: 5813 json_free(root); 5814 return ret; 5815 } 5816 5817 5818 int dpp_conf_resp_rx(struct dpp_authentication *auth, 5819 const struct wpabuf *resp) 5820 { 5821 const u8 *wrapped_data, *e_nonce, *status, *conf_obj; 5822 u16 wrapped_data_len, e_nonce_len, status_len, conf_obj_len; 5823 const u8 *addr[1]; 5824 size_t len[1]; 5825 u8 *unwrapped = NULL; 5826 size_t unwrapped_len = 0; 5827 int ret = -1; 5828 5829 auth->conf_resp_status = 255; 5830 5831 if (dpp_check_attrs(wpabuf_head(resp), wpabuf_len(resp)) < 0) { 5832 dpp_auth_fail(auth, "Invalid attribute in config response"); 5833 return -1; 5834 } 5835 5836 wrapped_data = dpp_get_attr(wpabuf_head(resp), wpabuf_len(resp), 5837 DPP_ATTR_WRAPPED_DATA, 5838 &wrapped_data_len); 5839 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 5840 dpp_auth_fail(auth, 5841 "Missing or invalid required Wrapped Data attribute"); 5842 return -1; 5843 } 5844 5845 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 5846 wrapped_data, wrapped_data_len); 5847 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 5848 unwrapped = os_malloc(unwrapped_len); 5849 if (!unwrapped) 5850 return -1; 5851 5852 addr[0] = wpabuf_head(resp); 5853 len[0] = wrapped_data - 4 - (const u8 *) wpabuf_head(resp); 5854 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD", addr[0], len[0]); 5855 5856 if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, 5857 wrapped_data, wrapped_data_len, 5858 1, addr, len, unwrapped) < 0) { 5859 dpp_auth_fail(auth, "AES-SIV decryption failed"); 5860 goto fail; 5861 } 5862 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 5863 unwrapped, unwrapped_len); 5864 5865 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 5866 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 5867 goto fail; 5868 } 5869 5870 e_nonce = dpp_get_attr(unwrapped, unwrapped_len, 5871 DPP_ATTR_ENROLLEE_NONCE, 5872 &e_nonce_len); 5873 if (!e_nonce || e_nonce_len != auth->curve->nonce_len) { 5874 dpp_auth_fail(auth, 5875 "Missing or invalid Enrollee Nonce attribute"); 5876 goto fail; 5877 } 5878 wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len); 5879 if (os_memcmp(e_nonce, auth->e_nonce, e_nonce_len) != 0) { 5880 dpp_auth_fail(auth, "Enrollee Nonce mismatch"); 5881 goto fail; 5882 } 5883 5884 status = dpp_get_attr(wpabuf_head(resp), wpabuf_len(resp), 5885 DPP_ATTR_STATUS, &status_len); 5886 if (!status || status_len < 1) { 5887 dpp_auth_fail(auth, 5888 "Missing or invalid required DPP Status attribute"); 5889 goto fail; 5890 } 5891 auth->conf_resp_status = status[0]; 5892 wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); 5893 if (status[0] != DPP_STATUS_OK) { 5894 dpp_auth_fail(auth, "Configurator rejected configuration"); 5895 goto fail; 5896 } 5897 5898 conf_obj = dpp_get_attr(unwrapped, unwrapped_len, 5899 DPP_ATTR_CONFIG_OBJ, &conf_obj_len); 5900 if (!conf_obj) { 5901 dpp_auth_fail(auth, 5902 "Missing required Configuration Object attribute"); 5903 goto fail; 5904 } 5905 wpa_hexdump_ascii(MSG_DEBUG, "DPP: configurationObject JSON", 5906 conf_obj, conf_obj_len); 5907 if (dpp_parse_conf_obj(auth, conf_obj, conf_obj_len) < 0) 5908 goto fail; 5909 5910 ret = 0; 5911 5912 fail: 5913 os_free(unwrapped); 5914 return ret; 5915 } 5916 5917 5918 #ifdef CONFIG_DPP2 5919 enum dpp_status_error dpp_conf_result_rx(struct dpp_authentication *auth, 5920 const u8 *hdr, 5921 const u8 *attr_start, size_t attr_len) 5922 { 5923 const u8 *wrapped_data, *status, *e_nonce; 5924 u16 wrapped_data_len, status_len, e_nonce_len; 5925 const u8 *addr[2]; 5926 size_t len[2]; 5927 u8 *unwrapped = NULL; 5928 size_t unwrapped_len = 0; 5929 enum dpp_status_error ret = 256; 5930 5931 wrapped_data = dpp_get_attr(attr_start, attr_len, DPP_ATTR_WRAPPED_DATA, 5932 &wrapped_data_len); 5933 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 5934 dpp_auth_fail(auth, 5935 "Missing or invalid required Wrapped Data attribute"); 5936 goto fail; 5937 } 5938 wpa_hexdump(MSG_DEBUG, "DPP: Wrapped data", 5939 wrapped_data, wrapped_data_len); 5940 5941 attr_len = wrapped_data - 4 - attr_start; 5942 5943 addr[0] = hdr; 5944 len[0] = DPP_HDR_LEN; 5945 addr[1] = attr_start; 5946 len[1] = attr_len; 5947 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 5948 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 5949 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 5950 wrapped_data, wrapped_data_len); 5951 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 5952 unwrapped = os_malloc(unwrapped_len); 5953 if (!unwrapped) 5954 goto fail; 5955 if (aes_siv_decrypt(auth->ke, auth->curve->hash_len, 5956 wrapped_data, wrapped_data_len, 5957 2, addr, len, unwrapped) < 0) { 5958 dpp_auth_fail(auth, "AES-SIV decryption failed"); 5959 goto fail; 5960 } 5961 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 5962 unwrapped, unwrapped_len); 5963 5964 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 5965 dpp_auth_fail(auth, "Invalid attribute in unwrapped data"); 5966 goto fail; 5967 } 5968 5969 e_nonce = dpp_get_attr(unwrapped, unwrapped_len, 5970 DPP_ATTR_ENROLLEE_NONCE, 5971 &e_nonce_len); 5972 if (!e_nonce || e_nonce_len != auth->curve->nonce_len) { 5973 dpp_auth_fail(auth, 5974 "Missing or invalid Enrollee Nonce attribute"); 5975 goto fail; 5976 } 5977 wpa_hexdump(MSG_DEBUG, "DPP: Enrollee Nonce", e_nonce, e_nonce_len); 5978 if (os_memcmp(e_nonce, auth->e_nonce, e_nonce_len) != 0) { 5979 dpp_auth_fail(auth, "Enrollee Nonce mismatch"); 5980 wpa_hexdump(MSG_DEBUG, "DPP: Expected Enrollee Nonce", 5981 auth->e_nonce, e_nonce_len); 5982 goto fail; 5983 } 5984 5985 status = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_STATUS, 5986 &status_len); 5987 if (!status || status_len < 1) { 5988 dpp_auth_fail(auth, 5989 "Missing or invalid required DPP Status attribute"); 5990 goto fail; 5991 } 5992 wpa_printf(MSG_DEBUG, "DPP: Status %u", status[0]); 5993 ret = status[0]; 5994 5995 fail: 5996 bin_clear_free(unwrapped, unwrapped_len); 5997 return ret; 5998 } 5999 #endif /* CONFIG_DPP2 */ 6000 6001 6002 struct wpabuf * dpp_build_conf_result(struct dpp_authentication *auth, 6003 enum dpp_status_error status) 6004 { 6005 struct wpabuf *msg, *clear; 6006 size_t nonce_len, clear_len, attr_len; 6007 const u8 *addr[2]; 6008 size_t len[2]; 6009 u8 *wrapped; 6010 6011 nonce_len = auth->curve->nonce_len; 6012 clear_len = 5 + 4 + nonce_len; 6013 attr_len = 4 + clear_len + AES_BLOCK_SIZE; 6014 clear = wpabuf_alloc(clear_len); 6015 msg = dpp_alloc_msg(DPP_PA_CONFIGURATION_RESULT, attr_len); 6016 if (!clear || !msg) 6017 return NULL; 6018 6019 /* DPP Status */ 6020 dpp_build_attr_status(clear, status); 6021 6022 /* E-nonce */ 6023 wpabuf_put_le16(clear, DPP_ATTR_ENROLLEE_NONCE); 6024 wpabuf_put_le16(clear, nonce_len); 6025 wpabuf_put_data(clear, auth->e_nonce, nonce_len); 6026 6027 /* OUI, OUI type, Crypto Suite, DPP frame type */ 6028 addr[0] = wpabuf_head_u8(msg) + 2; 6029 len[0] = 3 + 1 + 1 + 1; 6030 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 6031 6032 /* Attributes before Wrapped Data (none) */ 6033 addr[1] = wpabuf_put(msg, 0); 6034 len[1] = 0; 6035 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 6036 6037 /* Wrapped Data */ 6038 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 6039 wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 6040 wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 6041 6042 wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); 6043 if (aes_siv_encrypt(auth->ke, auth->curve->hash_len, 6044 wpabuf_head(clear), wpabuf_len(clear), 6045 2, addr, len, wrapped) < 0) 6046 goto fail; 6047 6048 wpa_hexdump_buf(MSG_DEBUG, "DPP: Configuration Result attributes", msg); 6049 wpabuf_free(clear); 6050 return msg; 6051 fail: 6052 wpabuf_free(clear); 6053 wpabuf_free(msg); 6054 return NULL; 6055 } 6056 6057 6058 void dpp_configurator_free(struct dpp_configurator *conf) 6059 { 6060 if (!conf) 6061 return; 6062 EVP_PKEY_free(conf->csign); 6063 os_free(conf->kid); 6064 os_free(conf); 6065 } 6066 6067 6068 int dpp_configurator_get_key(const struct dpp_configurator *conf, char *buf, 6069 size_t buflen) 6070 { 6071 EC_KEY *eckey; 6072 int key_len, ret = -1; 6073 unsigned char *key = NULL; 6074 6075 if (!conf->csign) 6076 return -1; 6077 6078 eckey = EVP_PKEY_get1_EC_KEY(conf->csign); 6079 if (!eckey) 6080 return -1; 6081 6082 key_len = i2d_ECPrivateKey(eckey, &key); 6083 if (key_len > 0) 6084 ret = wpa_snprintf_hex(buf, buflen, key, key_len); 6085 6086 EC_KEY_free(eckey); 6087 OPENSSL_free(key); 6088 return ret; 6089 } 6090 6091 6092 struct dpp_configurator * 6093 dpp_keygen_configurator(const char *curve, const u8 *privkey, 6094 size_t privkey_len) 6095 { 6096 struct dpp_configurator *conf; 6097 struct wpabuf *csign_pub = NULL; 6098 u8 kid_hash[SHA256_MAC_LEN]; 6099 const u8 *addr[1]; 6100 size_t len[1]; 6101 6102 conf = os_zalloc(sizeof(*conf)); 6103 if (!conf) 6104 return NULL; 6105 6106 if (!curve) { 6107 conf->curve = &dpp_curves[0]; 6108 } else { 6109 conf->curve = dpp_get_curve_name(curve); 6110 if (!conf->curve) { 6111 wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", 6112 curve); 6113 os_free(conf); 6114 return NULL; 6115 } 6116 } 6117 if (privkey) 6118 conf->csign = dpp_set_keypair(&conf->curve, privkey, 6119 privkey_len); 6120 else 6121 conf->csign = dpp_gen_keypair(conf->curve); 6122 if (!conf->csign) 6123 goto fail; 6124 conf->own = 1; 6125 6126 csign_pub = dpp_get_pubkey_point(conf->csign, 1); 6127 if (!csign_pub) { 6128 wpa_printf(MSG_INFO, "DPP: Failed to extract C-sign-key"); 6129 goto fail; 6130 } 6131 6132 /* kid = SHA256(ANSI X9.63 uncompressed C-sign-key) */ 6133 addr[0] = wpabuf_head(csign_pub); 6134 len[0] = wpabuf_len(csign_pub); 6135 if (sha256_vector(1, addr, len, kid_hash) < 0) { 6136 wpa_printf(MSG_DEBUG, 6137 "DPP: Failed to derive kid for C-sign-key"); 6138 goto fail; 6139 } 6140 6141 conf->kid = (char *) base64_url_encode(kid_hash, sizeof(kid_hash), 6142 NULL, 0); 6143 if (!conf->kid) 6144 goto fail; 6145 out: 6146 wpabuf_free(csign_pub); 6147 return conf; 6148 fail: 6149 dpp_configurator_free(conf); 6150 conf = NULL; 6151 goto out; 6152 } 6153 6154 6155 int dpp_configurator_own_config(struct dpp_authentication *auth, 6156 const char *curve, int ap) 6157 { 6158 struct wpabuf *conf_obj; 6159 int ret = -1; 6160 6161 if (!auth->conf) { 6162 wpa_printf(MSG_DEBUG, "DPP: No configurator specified"); 6163 return -1; 6164 } 6165 6166 if (!curve) { 6167 auth->curve = &dpp_curves[0]; 6168 } else { 6169 auth->curve = dpp_get_curve_name(curve); 6170 if (!auth->curve) { 6171 wpa_printf(MSG_INFO, "DPP: Unsupported curve: %s", 6172 curve); 6173 return -1; 6174 } 6175 } 6176 wpa_printf(MSG_DEBUG, 6177 "DPP: Building own configuration/connector with curve %s", 6178 auth->curve->name); 6179 6180 auth->own_protocol_key = dpp_gen_keypair(auth->curve); 6181 if (!auth->own_protocol_key) 6182 return -1; 6183 dpp_copy_netaccesskey(auth); 6184 auth->peer_protocol_key = auth->own_protocol_key; 6185 dpp_copy_csign(auth, auth->conf->csign); 6186 6187 conf_obj = dpp_build_conf_obj(auth, ap); 6188 if (!conf_obj) 6189 goto fail; 6190 ret = dpp_parse_conf_obj(auth, wpabuf_head(conf_obj), 6191 wpabuf_len(conf_obj)); 6192 fail: 6193 wpabuf_free(conf_obj); 6194 auth->peer_protocol_key = NULL; 6195 return ret; 6196 } 6197 6198 6199 static int dpp_compatible_netrole(const char *role1, const char *role2) 6200 { 6201 return (os_strcmp(role1, "sta") == 0 && os_strcmp(role2, "ap") == 0) || 6202 (os_strcmp(role1, "ap") == 0 && os_strcmp(role2, "sta") == 0); 6203 } 6204 6205 6206 static int dpp_connector_compatible_group(struct json_token *root, 6207 const char *group_id, 6208 const char *net_role) 6209 { 6210 struct json_token *groups, *token; 6211 6212 groups = json_get_member(root, "groups"); 6213 if (!groups || groups->type != JSON_ARRAY) 6214 return 0; 6215 6216 for (token = groups->child; token; token = token->sibling) { 6217 struct json_token *id, *role; 6218 6219 id = json_get_member(token, "groupId"); 6220 if (!id || id->type != JSON_STRING) 6221 continue; 6222 6223 role = json_get_member(token, "netRole"); 6224 if (!role || role->type != JSON_STRING) 6225 continue; 6226 6227 if (os_strcmp(id->string, "*") != 0 && 6228 os_strcmp(group_id, "*") != 0 && 6229 os_strcmp(id->string, group_id) != 0) 6230 continue; 6231 6232 if (dpp_compatible_netrole(role->string, net_role)) 6233 return 1; 6234 } 6235 6236 return 0; 6237 } 6238 6239 6240 static int dpp_connector_match_groups(struct json_token *own_root, 6241 struct json_token *peer_root) 6242 { 6243 struct json_token *groups, *token; 6244 6245 groups = json_get_member(peer_root, "groups"); 6246 if (!groups || groups->type != JSON_ARRAY) { 6247 wpa_printf(MSG_DEBUG, "DPP: No peer groups array found"); 6248 return 0; 6249 } 6250 6251 for (token = groups->child; token; token = token->sibling) { 6252 struct json_token *id, *role; 6253 6254 id = json_get_member(token, "groupId"); 6255 if (!id || id->type != JSON_STRING) { 6256 wpa_printf(MSG_DEBUG, 6257 "DPP: Missing peer groupId string"); 6258 continue; 6259 } 6260 6261 role = json_get_member(token, "netRole"); 6262 if (!role || role->type != JSON_STRING) { 6263 wpa_printf(MSG_DEBUG, 6264 "DPP: Missing peer groups::netRole string"); 6265 continue; 6266 } 6267 wpa_printf(MSG_DEBUG, 6268 "DPP: peer connector group: groupId='%s' netRole='%s'", 6269 id->string, role->string); 6270 if (dpp_connector_compatible_group(own_root, id->string, 6271 role->string)) { 6272 wpa_printf(MSG_DEBUG, 6273 "DPP: Compatible group/netRole in own connector"); 6274 return 1; 6275 } 6276 } 6277 6278 return 0; 6279 } 6280 6281 6282 static int dpp_derive_pmk(const u8 *Nx, size_t Nx_len, u8 *pmk, 6283 unsigned int hash_len) 6284 { 6285 u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; 6286 const char *info = "DPP PMK"; 6287 int res; 6288 6289 /* PMK = HKDF(<>, "DPP PMK", N.x) */ 6290 6291 /* HKDF-Extract(<>, N.x) */ 6292 os_memset(salt, 0, hash_len); 6293 if (dpp_hmac(hash_len, salt, hash_len, Nx, Nx_len, prk) < 0) 6294 return -1; 6295 wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM=N.x)", 6296 prk, hash_len); 6297 6298 /* HKDF-Expand(PRK, info, L) */ 6299 res = dpp_hkdf_expand(hash_len, prk, hash_len, info, pmk, hash_len); 6300 os_memset(prk, 0, hash_len); 6301 if (res < 0) 6302 return -1; 6303 6304 wpa_hexdump_key(MSG_DEBUG, "DPP: PMK = HKDF-Expand(PRK, info, L)", 6305 pmk, hash_len); 6306 return 0; 6307 } 6308 6309 6310 static int dpp_derive_pmkid(const struct dpp_curve_params *curve, 6311 EVP_PKEY *own_key, EVP_PKEY *peer_key, u8 *pmkid) 6312 { 6313 struct wpabuf *nkx, *pkx; 6314 int ret = -1, res; 6315 const u8 *addr[2]; 6316 size_t len[2]; 6317 u8 hash[SHA256_MAC_LEN]; 6318 6319 /* PMKID = Truncate-128(H(min(NK.x, PK.x) | max(NK.x, PK.x))) */ 6320 nkx = dpp_get_pubkey_point(own_key, 0); 6321 pkx = dpp_get_pubkey_point(peer_key, 0); 6322 if (!nkx || !pkx) 6323 goto fail; 6324 addr[0] = wpabuf_head(nkx); 6325 len[0] = wpabuf_len(nkx) / 2; 6326 addr[1] = wpabuf_head(pkx); 6327 len[1] = wpabuf_len(pkx) / 2; 6328 if (len[0] != len[1]) 6329 goto fail; 6330 if (os_memcmp(addr[0], addr[1], len[0]) > 0) { 6331 addr[0] = wpabuf_head(pkx); 6332 addr[1] = wpabuf_head(nkx); 6333 } 6334 wpa_hexdump(MSG_DEBUG, "DPP: PMKID hash payload 1", addr[0], len[0]); 6335 wpa_hexdump(MSG_DEBUG, "DPP: PMKID hash payload 2", addr[1], len[1]); 6336 res = sha256_vector(2, addr, len, hash); 6337 if (res < 0) 6338 goto fail; 6339 wpa_hexdump(MSG_DEBUG, "DPP: PMKID hash output", hash, SHA256_MAC_LEN); 6340 os_memcpy(pmkid, hash, PMKID_LEN); 6341 wpa_hexdump(MSG_DEBUG, "DPP: PMKID", pmkid, PMKID_LEN); 6342 ret = 0; 6343 fail: 6344 wpabuf_free(nkx); 6345 wpabuf_free(pkx); 6346 return ret; 6347 } 6348 6349 6350 enum dpp_status_error 6351 dpp_peer_intro(struct dpp_introduction *intro, const char *own_connector, 6352 const u8 *net_access_key, size_t net_access_key_len, 6353 const u8 *csign_key, size_t csign_key_len, 6354 const u8 *peer_connector, size_t peer_connector_len, 6355 os_time_t *expiry) 6356 { 6357 struct json_token *root = NULL, *netkey, *token; 6358 struct json_token *own_root = NULL; 6359 enum dpp_status_error ret = 255, res; 6360 EVP_PKEY *own_key = NULL, *peer_key = NULL; 6361 struct wpabuf *own_key_pub = NULL; 6362 const struct dpp_curve_params *curve, *own_curve; 6363 struct dpp_signed_connector_info info; 6364 const unsigned char *p; 6365 EVP_PKEY *csign = NULL; 6366 char *signed_connector = NULL; 6367 const char *pos, *end; 6368 unsigned char *own_conn = NULL; 6369 size_t own_conn_len; 6370 EVP_PKEY_CTX *ctx = NULL; 6371 size_t Nx_len; 6372 u8 Nx[DPP_MAX_SHARED_SECRET_LEN]; 6373 6374 os_memset(intro, 0, sizeof(*intro)); 6375 os_memset(&info, 0, sizeof(info)); 6376 if (expiry) 6377 *expiry = 0; 6378 6379 p = csign_key; 6380 csign = d2i_PUBKEY(NULL, &p, csign_key_len); 6381 if (!csign) { 6382 wpa_printf(MSG_ERROR, 6383 "DPP: Failed to parse local C-sign-key information"); 6384 goto fail; 6385 } 6386 6387 own_key = dpp_set_keypair(&own_curve, net_access_key, 6388 net_access_key_len); 6389 if (!own_key) { 6390 wpa_printf(MSG_ERROR, "DPP: Failed to parse own netAccessKey"); 6391 goto fail; 6392 } 6393 6394 pos = os_strchr(own_connector, '.'); 6395 if (!pos) { 6396 wpa_printf(MSG_DEBUG, "DPP: Own connector is missing the first dot (.)"); 6397 goto fail; 6398 } 6399 pos++; 6400 end = os_strchr(pos, '.'); 6401 if (!end) { 6402 wpa_printf(MSG_DEBUG, "DPP: Own connector is missing the second dot (.)"); 6403 goto fail; 6404 } 6405 own_conn = base64_url_decode((const unsigned char *) pos, 6406 end - pos, &own_conn_len); 6407 if (!own_conn) { 6408 wpa_printf(MSG_DEBUG, 6409 "DPP: Failed to base64url decode own signedConnector JWS Payload"); 6410 goto fail; 6411 } 6412 6413 own_root = json_parse((const char *) own_conn, own_conn_len); 6414 if (!own_root) { 6415 wpa_printf(MSG_DEBUG, "DPP: Failed to parse local connector"); 6416 goto fail; 6417 } 6418 6419 wpa_hexdump_ascii(MSG_DEBUG, "DPP: Peer signedConnector", 6420 peer_connector, peer_connector_len); 6421 signed_connector = os_malloc(peer_connector_len + 1); 6422 if (!signed_connector) 6423 goto fail; 6424 os_memcpy(signed_connector, peer_connector, peer_connector_len); 6425 signed_connector[peer_connector_len] = '\0'; 6426 6427 res = dpp_process_signed_connector(&info, csign, signed_connector); 6428 if (res != DPP_STATUS_OK) { 6429 ret = res; 6430 goto fail; 6431 } 6432 6433 root = json_parse((const char *) info.payload, info.payload_len); 6434 if (!root) { 6435 wpa_printf(MSG_DEBUG, "DPP: JSON parsing of connector failed"); 6436 ret = DPP_STATUS_INVALID_CONNECTOR; 6437 goto fail; 6438 } 6439 6440 if (!dpp_connector_match_groups(own_root, root)) { 6441 wpa_printf(MSG_DEBUG, 6442 "DPP: Peer connector does not include compatible group netrole with own connector"); 6443 ret = DPP_STATUS_NO_MATCH; 6444 goto fail; 6445 } 6446 6447 token = json_get_member(root, "expiry"); 6448 if (!token || token->type != JSON_STRING) { 6449 wpa_printf(MSG_DEBUG, 6450 "DPP: No expiry string found - connector does not expire"); 6451 } else { 6452 wpa_printf(MSG_DEBUG, "DPP: expiry = %s", token->string); 6453 if (dpp_key_expired(token->string, expiry)) { 6454 wpa_printf(MSG_DEBUG, 6455 "DPP: Connector (netAccessKey) has expired"); 6456 ret = DPP_STATUS_INVALID_CONNECTOR; 6457 goto fail; 6458 } 6459 } 6460 6461 netkey = json_get_member(root, "netAccessKey"); 6462 if (!netkey || netkey->type != JSON_OBJECT) { 6463 wpa_printf(MSG_DEBUG, "DPP: No netAccessKey object found"); 6464 ret = DPP_STATUS_INVALID_CONNECTOR; 6465 goto fail; 6466 } 6467 6468 peer_key = dpp_parse_jwk(netkey, &curve); 6469 if (!peer_key) { 6470 ret = DPP_STATUS_INVALID_CONNECTOR; 6471 goto fail; 6472 } 6473 dpp_debug_print_key("DPP: Received netAccessKey", peer_key); 6474 6475 if (own_curve != curve) { 6476 wpa_printf(MSG_DEBUG, 6477 "DPP: Mismatching netAccessKey curves (%s != %s)", 6478 own_curve->name, curve->name); 6479 ret = DPP_STATUS_INVALID_CONNECTOR; 6480 goto fail; 6481 } 6482 6483 /* ECDH: N = nk * PK */ 6484 ctx = EVP_PKEY_CTX_new(own_key, NULL); 6485 if (!ctx || 6486 EVP_PKEY_derive_init(ctx) != 1 || 6487 EVP_PKEY_derive_set_peer(ctx, peer_key) != 1 || 6488 EVP_PKEY_derive(ctx, NULL, &Nx_len) != 1 || 6489 Nx_len > DPP_MAX_SHARED_SECRET_LEN || 6490 EVP_PKEY_derive(ctx, Nx, &Nx_len) != 1) { 6491 wpa_printf(MSG_ERROR, 6492 "DPP: Failed to derive ECDH shared secret: %s", 6493 ERR_error_string(ERR_get_error(), NULL)); 6494 goto fail; 6495 } 6496 6497 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (N.x)", 6498 Nx, Nx_len); 6499 6500 /* PMK = HKDF(<>, "DPP PMK", N.x) */ 6501 if (dpp_derive_pmk(Nx, Nx_len, intro->pmk, curve->hash_len) < 0) { 6502 wpa_printf(MSG_ERROR, "DPP: Failed to derive PMK"); 6503 goto fail; 6504 } 6505 intro->pmk_len = curve->hash_len; 6506 6507 /* PMKID = Truncate-128(H(min(NK.x, PK.x) | max(NK.x, PK.x))) */ 6508 if (dpp_derive_pmkid(curve, own_key, peer_key, intro->pmkid) < 0) { 6509 wpa_printf(MSG_ERROR, "DPP: Failed to derive PMKID"); 6510 goto fail; 6511 } 6512 6513 ret = DPP_STATUS_OK; 6514 fail: 6515 if (ret != DPP_STATUS_OK) 6516 os_memset(intro, 0, sizeof(*intro)); 6517 os_memset(Nx, 0, sizeof(Nx)); 6518 EVP_PKEY_CTX_free(ctx); 6519 os_free(own_conn); 6520 os_free(signed_connector); 6521 os_free(info.payload); 6522 EVP_PKEY_free(own_key); 6523 wpabuf_free(own_key_pub); 6524 EVP_PKEY_free(peer_key); 6525 EVP_PKEY_free(csign); 6526 json_free(root); 6527 json_free(own_root); 6528 return ret; 6529 } 6530 6531 6532 static EVP_PKEY * dpp_pkex_get_role_elem(const struct dpp_curve_params *curve, 6533 int init) 6534 { 6535 EC_GROUP *group; 6536 size_t len = curve->prime_len; 6537 const u8 *x, *y; 6538 6539 switch (curve->ike_group) { 6540 case 19: 6541 x = init ? pkex_init_x_p256 : pkex_resp_x_p256; 6542 y = init ? pkex_init_y_p256 : pkex_resp_y_p256; 6543 break; 6544 case 20: 6545 x = init ? pkex_init_x_p384 : pkex_resp_x_p384; 6546 y = init ? pkex_init_y_p384 : pkex_resp_y_p384; 6547 break; 6548 case 21: 6549 x = init ? pkex_init_x_p521 : pkex_resp_x_p521; 6550 y = init ? pkex_init_y_p521 : pkex_resp_y_p521; 6551 break; 6552 case 28: 6553 x = init ? pkex_init_x_bp_p256r1 : pkex_resp_x_bp_p256r1; 6554 y = init ? pkex_init_y_bp_p256r1 : pkex_resp_y_bp_p256r1; 6555 break; 6556 case 29: 6557 x = init ? pkex_init_x_bp_p384r1 : pkex_resp_x_bp_p384r1; 6558 y = init ? pkex_init_y_bp_p384r1 : pkex_resp_y_bp_p384r1; 6559 break; 6560 case 30: 6561 x = init ? pkex_init_x_bp_p512r1 : pkex_resp_x_bp_p512r1; 6562 y = init ? pkex_init_y_bp_p512r1 : pkex_resp_y_bp_p512r1; 6563 break; 6564 default: 6565 return NULL; 6566 } 6567 6568 group = EC_GROUP_new_by_curve_name(OBJ_txt2nid(curve->name)); 6569 if (!group) 6570 return NULL; 6571 return dpp_set_pubkey_point_group(group, x, y, len); 6572 } 6573 6574 6575 static EC_POINT * dpp_pkex_derive_Qi(const struct dpp_curve_params *curve, 6576 const u8 *mac_init, const char *code, 6577 const char *identifier, BN_CTX *bnctx, 6578 const EC_GROUP **ret_group) 6579 { 6580 u8 hash[DPP_MAX_HASH_LEN]; 6581 const u8 *addr[3]; 6582 size_t len[3]; 6583 unsigned int num_elem = 0; 6584 EC_POINT *Qi = NULL; 6585 EVP_PKEY *Pi = NULL; 6586 EC_KEY *Pi_ec = NULL; 6587 const EC_POINT *Pi_point; 6588 BIGNUM *hash_bn = NULL; 6589 const EC_GROUP *group = NULL; 6590 EC_GROUP *group2 = NULL; 6591 6592 /* Qi = H(MAC-Initiator | [identifier |] code) * Pi */ 6593 6594 wpa_printf(MSG_DEBUG, "DPP: MAC-Initiator: " MACSTR, MAC2STR(mac_init)); 6595 addr[num_elem] = mac_init; 6596 len[num_elem] = ETH_ALEN; 6597 num_elem++; 6598 if (identifier) { 6599 wpa_printf(MSG_DEBUG, "DPP: code identifier: %s", 6600 identifier); 6601 addr[num_elem] = (const u8 *) identifier; 6602 len[num_elem] = os_strlen(identifier); 6603 num_elem++; 6604 } 6605 wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: code", code, os_strlen(code)); 6606 addr[num_elem] = (const u8 *) code; 6607 len[num_elem] = os_strlen(code); 6608 num_elem++; 6609 if (dpp_hash_vector(curve, num_elem, addr, len, hash) < 0) 6610 goto fail; 6611 wpa_hexdump_key(MSG_DEBUG, 6612 "DPP: H(MAC-Initiator | [identifier |] code)", 6613 hash, curve->hash_len); 6614 Pi = dpp_pkex_get_role_elem(curve, 1); 6615 if (!Pi) 6616 goto fail; 6617 dpp_debug_print_key("DPP: Pi", Pi); 6618 Pi_ec = EVP_PKEY_get1_EC_KEY(Pi); 6619 if (!Pi_ec) 6620 goto fail; 6621 Pi_point = EC_KEY_get0_public_key(Pi_ec); 6622 6623 group = EC_KEY_get0_group(Pi_ec); 6624 if (!group) 6625 goto fail; 6626 group2 = EC_GROUP_dup(group); 6627 if (!group2) 6628 goto fail; 6629 Qi = EC_POINT_new(group2); 6630 if (!Qi) { 6631 EC_GROUP_free(group2); 6632 goto fail; 6633 } 6634 hash_bn = BN_bin2bn(hash, curve->hash_len, NULL); 6635 if (!hash_bn || 6636 EC_POINT_mul(group2, Qi, NULL, Pi_point, hash_bn, bnctx) != 1) 6637 goto fail; 6638 if (EC_POINT_is_at_infinity(group, Qi)) { 6639 wpa_printf(MSG_INFO, "DPP: Qi is the point-at-infinity"); 6640 goto fail; 6641 } 6642 dpp_debug_print_point("DPP: Qi", group, Qi); 6643 out: 6644 EC_KEY_free(Pi_ec); 6645 EVP_PKEY_free(Pi); 6646 BN_clear_free(hash_bn); 6647 if (ret_group) 6648 *ret_group = group2; 6649 return Qi; 6650 fail: 6651 EC_POINT_free(Qi); 6652 Qi = NULL; 6653 goto out; 6654 } 6655 6656 6657 static EC_POINT * dpp_pkex_derive_Qr(const struct dpp_curve_params *curve, 6658 const u8 *mac_resp, const char *code, 6659 const char *identifier, BN_CTX *bnctx, 6660 const EC_GROUP **ret_group) 6661 { 6662 u8 hash[DPP_MAX_HASH_LEN]; 6663 const u8 *addr[3]; 6664 size_t len[3]; 6665 unsigned int num_elem = 0; 6666 EC_POINT *Qr = NULL; 6667 EVP_PKEY *Pr = NULL; 6668 EC_KEY *Pr_ec = NULL; 6669 const EC_POINT *Pr_point; 6670 BIGNUM *hash_bn = NULL; 6671 const EC_GROUP *group = NULL; 6672 EC_GROUP *group2 = NULL; 6673 6674 /* Qr = H(MAC-Responder | | [identifier | ] code) * Pr */ 6675 6676 wpa_printf(MSG_DEBUG, "DPP: MAC-Responder: " MACSTR, MAC2STR(mac_resp)); 6677 addr[num_elem] = mac_resp; 6678 len[num_elem] = ETH_ALEN; 6679 num_elem++; 6680 if (identifier) { 6681 wpa_printf(MSG_DEBUG, "DPP: code identifier: %s", 6682 identifier); 6683 addr[num_elem] = (const u8 *) identifier; 6684 len[num_elem] = os_strlen(identifier); 6685 num_elem++; 6686 } 6687 wpa_hexdump_ascii_key(MSG_DEBUG, "DPP: code", code, os_strlen(code)); 6688 addr[num_elem] = (const u8 *) code; 6689 len[num_elem] = os_strlen(code); 6690 num_elem++; 6691 if (dpp_hash_vector(curve, num_elem, addr, len, hash) < 0) 6692 goto fail; 6693 wpa_hexdump_key(MSG_DEBUG, 6694 "DPP: H(MAC-Responder | [identifier |] code)", 6695 hash, curve->hash_len); 6696 Pr = dpp_pkex_get_role_elem(curve, 0); 6697 if (!Pr) 6698 goto fail; 6699 dpp_debug_print_key("DPP: Pr", Pr); 6700 Pr_ec = EVP_PKEY_get1_EC_KEY(Pr); 6701 if (!Pr_ec) 6702 goto fail; 6703 Pr_point = EC_KEY_get0_public_key(Pr_ec); 6704 6705 group = EC_KEY_get0_group(Pr_ec); 6706 if (!group) 6707 goto fail; 6708 group2 = EC_GROUP_dup(group); 6709 if (!group2) 6710 goto fail; 6711 Qr = EC_POINT_new(group2); 6712 if (!Qr) { 6713 EC_GROUP_free(group2); 6714 goto fail; 6715 } 6716 hash_bn = BN_bin2bn(hash, curve->hash_len, NULL); 6717 if (!hash_bn || 6718 EC_POINT_mul(group2, Qr, NULL, Pr_point, hash_bn, bnctx) != 1) 6719 goto fail; 6720 if (EC_POINT_is_at_infinity(group, Qr)) { 6721 wpa_printf(MSG_INFO, "DPP: Qr is the point-at-infinity"); 6722 goto fail; 6723 } 6724 dpp_debug_print_point("DPP: Qr", group, Qr); 6725 out: 6726 EC_KEY_free(Pr_ec); 6727 EVP_PKEY_free(Pr); 6728 BN_clear_free(hash_bn); 6729 if (ret_group) 6730 *ret_group = group2; 6731 return Qr; 6732 fail: 6733 EC_POINT_free(Qr); 6734 Qr = NULL; 6735 goto out; 6736 } 6737 6738 6739 #ifdef CONFIG_TESTING_OPTIONS 6740 static int dpp_test_gen_invalid_key(struct wpabuf *msg, 6741 const struct dpp_curve_params *curve) 6742 { 6743 BN_CTX *ctx; 6744 BIGNUM *x, *y; 6745 int ret = -1; 6746 EC_GROUP *group; 6747 EC_POINT *point; 6748 6749 group = EC_GROUP_new_by_curve_name(OBJ_txt2nid(curve->name)); 6750 if (!group) 6751 return -1; 6752 6753 ctx = BN_CTX_new(); 6754 point = EC_POINT_new(group); 6755 x = BN_new(); 6756 y = BN_new(); 6757 if (!ctx || !point || !x || !y) 6758 goto fail; 6759 6760 if (BN_rand(x, curve->prime_len * 8, 0, 0) != 1) 6761 goto fail; 6762 6763 /* Generate a random y coordinate that results in a point that is not 6764 * on the curve. */ 6765 for (;;) { 6766 if (BN_rand(y, curve->prime_len * 8, 0, 0) != 1) 6767 goto fail; 6768 6769 if (EC_POINT_set_affine_coordinates_GFp(group, point, x, y, 6770 ctx) != 1) { 6771 #if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(OPENSSL_IS_BORINGSSL) 6772 /* Unlike older OpenSSL versions, OpenSSL 1.1.1 and BoringSSL 6773 * return an error from EC_POINT_set_affine_coordinates_GFp() 6774 * when the point is not on the curve. */ 6775 break; 6776 #else /* >=1.1.0 or OPENSSL_IS_BORINGSSL */ 6777 goto fail; 6778 #endif /* >= 1.1.0 or OPENSSL_IS_BORINGSSL */ 6779 } 6780 6781 if (!EC_POINT_is_on_curve(group, point, ctx)) 6782 break; 6783 } 6784 6785 if (dpp_bn2bin_pad(x, wpabuf_put(msg, curve->prime_len), 6786 curve->prime_len) < 0 || 6787 dpp_bn2bin_pad(y, wpabuf_put(msg, curve->prime_len), 6788 curve->prime_len) < 0) 6789 goto fail; 6790 6791 ret = 0; 6792 fail: 6793 if (ret < 0) 6794 wpa_printf(MSG_INFO, "DPP: Failed to generate invalid key"); 6795 BN_free(x); 6796 BN_free(y); 6797 EC_POINT_free(point); 6798 BN_CTX_free(ctx); 6799 6800 return ret; 6801 } 6802 #endif /* CONFIG_TESTING_OPTIONS */ 6803 6804 6805 static struct wpabuf * dpp_pkex_build_exchange_req(struct dpp_pkex *pkex) 6806 { 6807 EC_KEY *X_ec = NULL; 6808 const EC_POINT *X_point; 6809 BN_CTX *bnctx = NULL; 6810 const EC_GROUP *group; 6811 EC_POINT *Qi = NULL, *M = NULL; 6812 struct wpabuf *M_buf = NULL; 6813 BIGNUM *Mx = NULL, *My = NULL; 6814 struct wpabuf *msg = NULL; 6815 size_t attr_len; 6816 const struct dpp_curve_params *curve = pkex->own_bi->curve; 6817 6818 wpa_printf(MSG_DEBUG, "DPP: Build PKEX Exchange Request"); 6819 6820 /* Qi = H(MAC-Initiator | [identifier |] code) * Pi */ 6821 bnctx = BN_CTX_new(); 6822 if (!bnctx) 6823 goto fail; 6824 Qi = dpp_pkex_derive_Qi(curve, pkex->own_mac, pkex->code, 6825 pkex->identifier, bnctx, &group); 6826 if (!Qi) 6827 goto fail; 6828 6829 /* Generate a random ephemeral keypair x/X */ 6830 #ifdef CONFIG_TESTING_OPTIONS 6831 if (dpp_pkex_ephemeral_key_override_len) { 6832 const struct dpp_curve_params *tmp_curve; 6833 6834 wpa_printf(MSG_INFO, 6835 "DPP: TESTING - override ephemeral key x/X"); 6836 pkex->x = dpp_set_keypair(&tmp_curve, 6837 dpp_pkex_ephemeral_key_override, 6838 dpp_pkex_ephemeral_key_override_len); 6839 } else { 6840 pkex->x = dpp_gen_keypair(curve); 6841 } 6842 #else /* CONFIG_TESTING_OPTIONS */ 6843 pkex->x = dpp_gen_keypair(curve); 6844 #endif /* CONFIG_TESTING_OPTIONS */ 6845 if (!pkex->x) 6846 goto fail; 6847 6848 /* M = X + Qi */ 6849 X_ec = EVP_PKEY_get1_EC_KEY(pkex->x); 6850 if (!X_ec) 6851 goto fail; 6852 X_point = EC_KEY_get0_public_key(X_ec); 6853 if (!X_point) 6854 goto fail; 6855 dpp_debug_print_point("DPP: X", group, X_point); 6856 M = EC_POINT_new(group); 6857 Mx = BN_new(); 6858 My = BN_new(); 6859 if (!M || !Mx || !My || 6860 EC_POINT_add(group, M, X_point, Qi, bnctx) != 1 || 6861 EC_POINT_get_affine_coordinates_GFp(group, M, Mx, My, bnctx) != 1) 6862 goto fail; 6863 dpp_debug_print_point("DPP: M", group, M); 6864 6865 /* Initiator -> Responder: group, [identifier,] M */ 6866 attr_len = 4 + 2; 6867 if (pkex->identifier) 6868 attr_len += 4 + os_strlen(pkex->identifier); 6869 attr_len += 4 + 2 * curve->prime_len; 6870 msg = dpp_alloc_msg(DPP_PA_PKEX_EXCHANGE_REQ, attr_len); 6871 if (!msg) 6872 goto fail; 6873 6874 #ifdef CONFIG_TESTING_OPTIONS 6875 if (dpp_test == DPP_TEST_NO_FINITE_CYCLIC_GROUP_PKEX_EXCHANGE_REQ) { 6876 wpa_printf(MSG_INFO, "DPP: TESTING - no Finite Cyclic Group"); 6877 goto skip_finite_cyclic_group; 6878 } 6879 #endif /* CONFIG_TESTING_OPTIONS */ 6880 6881 /* Finite Cyclic Group attribute */ 6882 wpabuf_put_le16(msg, DPP_ATTR_FINITE_CYCLIC_GROUP); 6883 wpabuf_put_le16(msg, 2); 6884 wpabuf_put_le16(msg, curve->ike_group); 6885 6886 #ifdef CONFIG_TESTING_OPTIONS 6887 skip_finite_cyclic_group: 6888 #endif /* CONFIG_TESTING_OPTIONS */ 6889 6890 /* Code Identifier attribute */ 6891 if (pkex->identifier) { 6892 wpabuf_put_le16(msg, DPP_ATTR_CODE_IDENTIFIER); 6893 wpabuf_put_le16(msg, os_strlen(pkex->identifier)); 6894 wpabuf_put_str(msg, pkex->identifier); 6895 } 6896 6897 #ifdef CONFIG_TESTING_OPTIONS 6898 if (dpp_test == DPP_TEST_NO_ENCRYPTED_KEY_PKEX_EXCHANGE_REQ) { 6899 wpa_printf(MSG_INFO, "DPP: TESTING - no Encrypted Key"); 6900 goto out; 6901 } 6902 #endif /* CONFIG_TESTING_OPTIONS */ 6903 6904 /* M in Encrypted Key attribute */ 6905 wpabuf_put_le16(msg, DPP_ATTR_ENCRYPTED_KEY); 6906 wpabuf_put_le16(msg, 2 * curve->prime_len); 6907 6908 #ifdef CONFIG_TESTING_OPTIONS 6909 if (dpp_test == DPP_TEST_INVALID_ENCRYPTED_KEY_PKEX_EXCHANGE_REQ) { 6910 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Encrypted Key"); 6911 if (dpp_test_gen_invalid_key(msg, curve) < 0) 6912 goto fail; 6913 goto out; 6914 } 6915 #endif /* CONFIG_TESTING_OPTIONS */ 6916 6917 if (dpp_bn2bin_pad(Mx, wpabuf_put(msg, curve->prime_len), 6918 curve->prime_len) < 0 || 6919 dpp_bn2bin_pad(Mx, pkex->Mx, curve->prime_len) < 0 || 6920 dpp_bn2bin_pad(My, wpabuf_put(msg, curve->prime_len), 6921 curve->prime_len) < 0) 6922 goto fail; 6923 6924 out: 6925 wpabuf_free(M_buf); 6926 EC_KEY_free(X_ec); 6927 EC_POINT_free(M); 6928 EC_POINT_free(Qi); 6929 BN_clear_free(Mx); 6930 BN_clear_free(My); 6931 BN_CTX_free(bnctx); 6932 return msg; 6933 fail: 6934 wpa_printf(MSG_INFO, "DPP: Failed to build PKEX Exchange Request"); 6935 wpabuf_free(msg); 6936 msg = NULL; 6937 goto out; 6938 } 6939 6940 6941 static void dpp_pkex_fail(struct dpp_pkex *pkex, const char *txt) 6942 { 6943 wpa_msg(pkex->msg_ctx, MSG_INFO, DPP_EVENT_FAIL "%s", txt); 6944 } 6945 6946 6947 struct dpp_pkex * dpp_pkex_init(void *msg_ctx, struct dpp_bootstrap_info *bi, 6948 const u8 *own_mac, 6949 const char *identifier, 6950 const char *code) 6951 { 6952 struct dpp_pkex *pkex; 6953 6954 #ifdef CONFIG_TESTING_OPTIONS 6955 if (!is_zero_ether_addr(dpp_pkex_own_mac_override)) { 6956 wpa_printf(MSG_INFO, "DPP: TESTING - own_mac override " MACSTR, 6957 MAC2STR(dpp_pkex_own_mac_override)); 6958 own_mac = dpp_pkex_own_mac_override; 6959 } 6960 #endif /* CONFIG_TESTING_OPTIONS */ 6961 6962 pkex = os_zalloc(sizeof(*pkex)); 6963 if (!pkex) 6964 return NULL; 6965 pkex->msg_ctx = msg_ctx; 6966 pkex->initiator = 1; 6967 pkex->own_bi = bi; 6968 os_memcpy(pkex->own_mac, own_mac, ETH_ALEN); 6969 if (identifier) { 6970 pkex->identifier = os_strdup(identifier); 6971 if (!pkex->identifier) 6972 goto fail; 6973 } 6974 pkex->code = os_strdup(code); 6975 if (!pkex->code) 6976 goto fail; 6977 pkex->exchange_req = dpp_pkex_build_exchange_req(pkex); 6978 if (!pkex->exchange_req) 6979 goto fail; 6980 return pkex; 6981 fail: 6982 dpp_pkex_free(pkex); 6983 return NULL; 6984 } 6985 6986 6987 static struct wpabuf * 6988 dpp_pkex_build_exchange_resp(struct dpp_pkex *pkex, 6989 enum dpp_status_error status, 6990 const BIGNUM *Nx, const BIGNUM *Ny) 6991 { 6992 struct wpabuf *msg = NULL; 6993 size_t attr_len; 6994 const struct dpp_curve_params *curve = pkex->own_bi->curve; 6995 6996 /* Initiator -> Responder: DPP Status, [identifier,] N */ 6997 attr_len = 4 + 1; 6998 if (pkex->identifier) 6999 attr_len += 4 + os_strlen(pkex->identifier); 7000 attr_len += 4 + 2 * curve->prime_len; 7001 msg = dpp_alloc_msg(DPP_PA_PKEX_EXCHANGE_RESP, attr_len); 7002 if (!msg) 7003 goto fail; 7004 7005 #ifdef CONFIG_TESTING_OPTIONS 7006 if (dpp_test == DPP_TEST_NO_STATUS_PKEX_EXCHANGE_RESP) { 7007 wpa_printf(MSG_INFO, "DPP: TESTING - no Status"); 7008 goto skip_status; 7009 } 7010 7011 if (dpp_test == DPP_TEST_INVALID_STATUS_PKEX_EXCHANGE_RESP) { 7012 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Status"); 7013 status = 255; 7014 } 7015 #endif /* CONFIG_TESTING_OPTIONS */ 7016 7017 /* DPP Status */ 7018 dpp_build_attr_status(msg, status); 7019 7020 #ifdef CONFIG_TESTING_OPTIONS 7021 skip_status: 7022 #endif /* CONFIG_TESTING_OPTIONS */ 7023 7024 /* Code Identifier attribute */ 7025 if (pkex->identifier) { 7026 wpabuf_put_le16(msg, DPP_ATTR_CODE_IDENTIFIER); 7027 wpabuf_put_le16(msg, os_strlen(pkex->identifier)); 7028 wpabuf_put_str(msg, pkex->identifier); 7029 } 7030 7031 if (status != DPP_STATUS_OK) 7032 goto skip_encrypted_key; 7033 7034 #ifdef CONFIG_TESTING_OPTIONS 7035 if (dpp_test == DPP_TEST_NO_ENCRYPTED_KEY_PKEX_EXCHANGE_RESP) { 7036 wpa_printf(MSG_INFO, "DPP: TESTING - no Encrypted Key"); 7037 goto skip_encrypted_key; 7038 } 7039 #endif /* CONFIG_TESTING_OPTIONS */ 7040 7041 /* N in Encrypted Key attribute */ 7042 wpabuf_put_le16(msg, DPP_ATTR_ENCRYPTED_KEY); 7043 wpabuf_put_le16(msg, 2 * curve->prime_len); 7044 7045 #ifdef CONFIG_TESTING_OPTIONS 7046 if (dpp_test == DPP_TEST_INVALID_ENCRYPTED_KEY_PKEX_EXCHANGE_RESP) { 7047 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Encrypted Key"); 7048 if (dpp_test_gen_invalid_key(msg, curve) < 0) 7049 goto fail; 7050 goto skip_encrypted_key; 7051 } 7052 #endif /* CONFIG_TESTING_OPTIONS */ 7053 7054 if (dpp_bn2bin_pad(Nx, wpabuf_put(msg, curve->prime_len), 7055 curve->prime_len) < 0 || 7056 dpp_bn2bin_pad(Nx, pkex->Nx, curve->prime_len) < 0 || 7057 dpp_bn2bin_pad(Ny, wpabuf_put(msg, curve->prime_len), 7058 curve->prime_len) < 0) 7059 goto fail; 7060 7061 skip_encrypted_key: 7062 if (status == DPP_STATUS_BAD_GROUP) { 7063 /* Finite Cyclic Group attribute */ 7064 wpabuf_put_le16(msg, DPP_ATTR_FINITE_CYCLIC_GROUP); 7065 wpabuf_put_le16(msg, 2); 7066 wpabuf_put_le16(msg, curve->ike_group); 7067 } 7068 7069 return msg; 7070 fail: 7071 wpabuf_free(msg); 7072 return NULL; 7073 } 7074 7075 7076 static int dpp_pkex_derive_z(const u8 *mac_init, const u8 *mac_resp, 7077 const u8 *Mx, size_t Mx_len, 7078 const u8 *Nx, size_t Nx_len, 7079 const char *code, 7080 const u8 *Kx, size_t Kx_len, 7081 u8 *z, unsigned int hash_len) 7082 { 7083 u8 salt[DPP_MAX_HASH_LEN], prk[DPP_MAX_HASH_LEN]; 7084 int res; 7085 u8 *info, *pos; 7086 size_t info_len; 7087 7088 /* z = HKDF(<>, MAC-Initiator | MAC-Responder | M.x | N.x | code, K.x) 7089 */ 7090 7091 /* HKDF-Extract(<>, IKM=K.x) */ 7092 os_memset(salt, 0, hash_len); 7093 if (dpp_hmac(hash_len, salt, hash_len, Kx, Kx_len, prk) < 0) 7094 return -1; 7095 wpa_hexdump_key(MSG_DEBUG, "DPP: PRK = HKDF-Extract(<>, IKM)", 7096 prk, hash_len); 7097 info_len = 2 * ETH_ALEN + Mx_len + Nx_len + os_strlen(code); 7098 info = os_malloc(info_len); 7099 if (!info) 7100 return -1; 7101 pos = info; 7102 os_memcpy(pos, mac_init, ETH_ALEN); 7103 pos += ETH_ALEN; 7104 os_memcpy(pos, mac_resp, ETH_ALEN); 7105 pos += ETH_ALEN; 7106 os_memcpy(pos, Mx, Mx_len); 7107 pos += Mx_len; 7108 os_memcpy(pos, Nx, Nx_len); 7109 pos += Nx_len; 7110 os_memcpy(pos, code, os_strlen(code)); 7111 7112 /* HKDF-Expand(PRK, info, L) */ 7113 if (hash_len == 32) 7114 res = hmac_sha256_kdf(prk, hash_len, NULL, info, info_len, 7115 z, hash_len); 7116 else if (hash_len == 48) 7117 res = hmac_sha384_kdf(prk, hash_len, NULL, info, info_len, 7118 z, hash_len); 7119 else if (hash_len == 64) 7120 res = hmac_sha512_kdf(prk, hash_len, NULL, info, info_len, 7121 z, hash_len); 7122 else 7123 res = -1; 7124 os_free(info); 7125 os_memset(prk, 0, hash_len); 7126 if (res < 0) 7127 return -1; 7128 7129 wpa_hexdump_key(MSG_DEBUG, "DPP: z = HKDF-Expand(PRK, info, L)", 7130 z, hash_len); 7131 return 0; 7132 } 7133 7134 7135 static int dpp_pkex_identifier_match(const u8 *attr_id, u16 attr_id_len, 7136 const char *identifier) 7137 { 7138 if (!attr_id && identifier) { 7139 wpa_printf(MSG_DEBUG, 7140 "DPP: No PKEX code identifier received, but expected one"); 7141 return 0; 7142 } 7143 7144 if (attr_id && !identifier) { 7145 wpa_printf(MSG_DEBUG, 7146 "DPP: PKEX code identifier received, but not expecting one"); 7147 return 0; 7148 } 7149 7150 if (attr_id && identifier && 7151 (os_strlen(identifier) != attr_id_len || 7152 os_memcmp(identifier, attr_id, attr_id_len) != 0)) { 7153 wpa_printf(MSG_DEBUG, "DPP: PKEX code identifier mismatch"); 7154 return 0; 7155 } 7156 7157 return 1; 7158 } 7159 7160 7161 struct dpp_pkex * dpp_pkex_rx_exchange_req(void *msg_ctx, 7162 struct dpp_bootstrap_info *bi, 7163 const u8 *own_mac, 7164 const u8 *peer_mac, 7165 const char *identifier, 7166 const char *code, 7167 const u8 *buf, size_t len) 7168 { 7169 const u8 *attr_group, *attr_id, *attr_key; 7170 u16 attr_group_len, attr_id_len, attr_key_len; 7171 const struct dpp_curve_params *curve = bi->curve; 7172 u16 ike_group; 7173 struct dpp_pkex *pkex = NULL; 7174 EC_POINT *Qi = NULL, *Qr = NULL, *M = NULL, *X = NULL, *N = NULL; 7175 BN_CTX *bnctx = NULL; 7176 const EC_GROUP *group; 7177 BIGNUM *Mx = NULL, *My = NULL; 7178 EC_KEY *Y_ec = NULL, *X_ec = NULL;; 7179 const EC_POINT *Y_point; 7180 BIGNUM *Nx = NULL, *Ny = NULL; 7181 u8 Kx[DPP_MAX_SHARED_SECRET_LEN]; 7182 size_t Kx_len; 7183 int res; 7184 EVP_PKEY_CTX *ctx = NULL; 7185 7186 if (bi->pkex_t >= PKEX_COUNTER_T_LIMIT) { 7187 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7188 "PKEX counter t limit reached - ignore message"); 7189 return NULL; 7190 } 7191 7192 #ifdef CONFIG_TESTING_OPTIONS 7193 if (!is_zero_ether_addr(dpp_pkex_peer_mac_override)) { 7194 wpa_printf(MSG_INFO, "DPP: TESTING - peer_mac override " MACSTR, 7195 MAC2STR(dpp_pkex_peer_mac_override)); 7196 peer_mac = dpp_pkex_peer_mac_override; 7197 } 7198 if (!is_zero_ether_addr(dpp_pkex_own_mac_override)) { 7199 wpa_printf(MSG_INFO, "DPP: TESTING - own_mac override " MACSTR, 7200 MAC2STR(dpp_pkex_own_mac_override)); 7201 own_mac = dpp_pkex_own_mac_override; 7202 } 7203 #endif /* CONFIG_TESTING_OPTIONS */ 7204 7205 attr_id_len = 0; 7206 attr_id = dpp_get_attr(buf, len, DPP_ATTR_CODE_IDENTIFIER, 7207 &attr_id_len); 7208 if (!dpp_pkex_identifier_match(attr_id, attr_id_len, identifier)) 7209 return NULL; 7210 7211 attr_group = dpp_get_attr(buf, len, DPP_ATTR_FINITE_CYCLIC_GROUP, 7212 &attr_group_len); 7213 if (!attr_group || attr_group_len != 2) { 7214 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7215 "Missing or invalid Finite Cyclic Group attribute"); 7216 return NULL; 7217 } 7218 ike_group = WPA_GET_LE16(attr_group); 7219 if (ike_group != curve->ike_group) { 7220 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7221 "Mismatching PKEX curve: peer=%u own=%u", 7222 ike_group, curve->ike_group); 7223 pkex = os_zalloc(sizeof(*pkex)); 7224 if (!pkex) 7225 goto fail; 7226 pkex->own_bi = bi; 7227 pkex->failed = 1; 7228 pkex->exchange_resp = dpp_pkex_build_exchange_resp( 7229 pkex, DPP_STATUS_BAD_GROUP, NULL, NULL); 7230 if (!pkex->exchange_resp) 7231 goto fail; 7232 return pkex; 7233 } 7234 7235 /* M in Encrypted Key attribute */ 7236 attr_key = dpp_get_attr(buf, len, DPP_ATTR_ENCRYPTED_KEY, 7237 &attr_key_len); 7238 if (!attr_key || attr_key_len & 0x01 || attr_key_len < 2 || 7239 attr_key_len / 2 > DPP_MAX_SHARED_SECRET_LEN) { 7240 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7241 "Missing Encrypted Key attribute"); 7242 return NULL; 7243 } 7244 7245 /* Qi = H(MAC-Initiator | [identifier |] code) * Pi */ 7246 bnctx = BN_CTX_new(); 7247 if (!bnctx) 7248 goto fail; 7249 Qi = dpp_pkex_derive_Qi(curve, peer_mac, code, identifier, bnctx, 7250 &group); 7251 if (!Qi) 7252 goto fail; 7253 7254 /* X' = M - Qi */ 7255 X = EC_POINT_new(group); 7256 M = EC_POINT_new(group); 7257 Mx = BN_bin2bn(attr_key, attr_key_len / 2, NULL); 7258 My = BN_bin2bn(attr_key + attr_key_len / 2, attr_key_len / 2, NULL); 7259 if (!X || !M || !Mx || !My || 7260 EC_POINT_set_affine_coordinates_GFp(group, M, Mx, My, bnctx) != 1 || 7261 EC_POINT_is_at_infinity(group, M) || 7262 !EC_POINT_is_on_curve(group, M, bnctx) || 7263 EC_POINT_invert(group, Qi, bnctx) != 1 || 7264 EC_POINT_add(group, X, M, Qi, bnctx) != 1 || 7265 EC_POINT_is_at_infinity(group, X) || 7266 !EC_POINT_is_on_curve(group, X, bnctx)) { 7267 wpa_msg(msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7268 "Invalid Encrypted Key value"); 7269 bi->pkex_t++; 7270 goto fail; 7271 } 7272 dpp_debug_print_point("DPP: M", group, M); 7273 dpp_debug_print_point("DPP: X'", group, X); 7274 7275 pkex = os_zalloc(sizeof(*pkex)); 7276 if (!pkex) 7277 goto fail; 7278 pkex->t = bi->pkex_t; 7279 pkex->msg_ctx = msg_ctx; 7280 pkex->own_bi = bi; 7281 os_memcpy(pkex->own_mac, own_mac, ETH_ALEN); 7282 os_memcpy(pkex->peer_mac, peer_mac, ETH_ALEN); 7283 if (identifier) { 7284 pkex->identifier = os_strdup(identifier); 7285 if (!pkex->identifier) 7286 goto fail; 7287 } 7288 pkex->code = os_strdup(code); 7289 if (!pkex->code) 7290 goto fail; 7291 7292 os_memcpy(pkex->Mx, attr_key, attr_key_len / 2); 7293 7294 X_ec = EC_KEY_new(); 7295 if (!X_ec || 7296 EC_KEY_set_group(X_ec, group) != 1 || 7297 EC_KEY_set_public_key(X_ec, X) != 1) 7298 goto fail; 7299 pkex->x = EVP_PKEY_new(); 7300 if (!pkex->x || 7301 EVP_PKEY_set1_EC_KEY(pkex->x, X_ec) != 1) 7302 goto fail; 7303 7304 /* Qr = H(MAC-Responder | | [identifier | ] code) * Pr */ 7305 Qr = dpp_pkex_derive_Qr(curve, own_mac, code, identifier, bnctx, NULL); 7306 if (!Qr) 7307 goto fail; 7308 7309 /* Generate a random ephemeral keypair y/Y */ 7310 #ifdef CONFIG_TESTING_OPTIONS 7311 if (dpp_pkex_ephemeral_key_override_len) { 7312 const struct dpp_curve_params *tmp_curve; 7313 7314 wpa_printf(MSG_INFO, 7315 "DPP: TESTING - override ephemeral key y/Y"); 7316 pkex->y = dpp_set_keypair(&tmp_curve, 7317 dpp_pkex_ephemeral_key_override, 7318 dpp_pkex_ephemeral_key_override_len); 7319 } else { 7320 pkex->y = dpp_gen_keypair(curve); 7321 } 7322 #else /* CONFIG_TESTING_OPTIONS */ 7323 pkex->y = dpp_gen_keypair(curve); 7324 #endif /* CONFIG_TESTING_OPTIONS */ 7325 if (!pkex->y) 7326 goto fail; 7327 7328 /* N = Y + Qr */ 7329 Y_ec = EVP_PKEY_get1_EC_KEY(pkex->y); 7330 if (!Y_ec) 7331 goto fail; 7332 Y_point = EC_KEY_get0_public_key(Y_ec); 7333 if (!Y_point) 7334 goto fail; 7335 dpp_debug_print_point("DPP: Y", group, Y_point); 7336 N = EC_POINT_new(group); 7337 Nx = BN_new(); 7338 Ny = BN_new(); 7339 if (!N || !Nx || !Ny || 7340 EC_POINT_add(group, N, Y_point, Qr, bnctx) != 1 || 7341 EC_POINT_get_affine_coordinates_GFp(group, N, Nx, Ny, bnctx) != 1) 7342 goto fail; 7343 dpp_debug_print_point("DPP: N", group, N); 7344 7345 pkex->exchange_resp = dpp_pkex_build_exchange_resp(pkex, DPP_STATUS_OK, 7346 Nx, Ny); 7347 if (!pkex->exchange_resp) 7348 goto fail; 7349 7350 /* K = y * X' */ 7351 ctx = EVP_PKEY_CTX_new(pkex->y, NULL); 7352 if (!ctx || 7353 EVP_PKEY_derive_init(ctx) != 1 || 7354 EVP_PKEY_derive_set_peer(ctx, pkex->x) != 1 || 7355 EVP_PKEY_derive(ctx, NULL, &Kx_len) != 1 || 7356 Kx_len > DPP_MAX_SHARED_SECRET_LEN || 7357 EVP_PKEY_derive(ctx, Kx, &Kx_len) != 1) { 7358 wpa_printf(MSG_ERROR, 7359 "DPP: Failed to derive ECDH shared secret: %s", 7360 ERR_error_string(ERR_get_error(), NULL)); 7361 goto fail; 7362 } 7363 7364 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (K.x)", 7365 Kx, Kx_len); 7366 7367 /* z = HKDF(<>, MAC-Initiator | MAC-Responder | M.x | N.x | code, K.x) 7368 */ 7369 res = dpp_pkex_derive_z(pkex->peer_mac, pkex->own_mac, 7370 pkex->Mx, curve->prime_len, 7371 pkex->Nx, curve->prime_len, pkex->code, 7372 Kx, Kx_len, pkex->z, curve->hash_len); 7373 os_memset(Kx, 0, Kx_len); 7374 if (res < 0) 7375 goto fail; 7376 7377 pkex->exchange_done = 1; 7378 7379 out: 7380 EVP_PKEY_CTX_free(ctx); 7381 BN_CTX_free(bnctx); 7382 EC_POINT_free(Qi); 7383 EC_POINT_free(Qr); 7384 BN_free(Mx); 7385 BN_free(My); 7386 BN_free(Nx); 7387 BN_free(Ny); 7388 EC_POINT_free(M); 7389 EC_POINT_free(N); 7390 EC_POINT_free(X); 7391 EC_KEY_free(X_ec); 7392 EC_KEY_free(Y_ec); 7393 return pkex; 7394 fail: 7395 wpa_printf(MSG_DEBUG, "DPP: PKEX Exchange Request processing failed"); 7396 dpp_pkex_free(pkex); 7397 pkex = NULL; 7398 goto out; 7399 } 7400 7401 7402 static struct wpabuf * 7403 dpp_pkex_build_commit_reveal_req(struct dpp_pkex *pkex, 7404 const struct wpabuf *A_pub, const u8 *u) 7405 { 7406 const struct dpp_curve_params *curve = pkex->own_bi->curve; 7407 struct wpabuf *msg = NULL; 7408 size_t clear_len, attr_len; 7409 struct wpabuf *clear = NULL; 7410 u8 *wrapped; 7411 u8 octet; 7412 const u8 *addr[2]; 7413 size_t len[2]; 7414 7415 /* {A, u, [bootstrapping info]}z */ 7416 clear_len = 4 + 2 * curve->prime_len + 4 + curve->hash_len; 7417 clear = wpabuf_alloc(clear_len); 7418 attr_len = 4 + clear_len + AES_BLOCK_SIZE; 7419 #ifdef CONFIG_TESTING_OPTIONS 7420 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_REQ) 7421 attr_len += 5; 7422 #endif /* CONFIG_TESTING_OPTIONS */ 7423 msg = dpp_alloc_msg(DPP_PA_PKEX_COMMIT_REVEAL_REQ, attr_len); 7424 if (!clear || !msg) 7425 goto fail; 7426 7427 #ifdef CONFIG_TESTING_OPTIONS 7428 if (dpp_test == DPP_TEST_NO_BOOTSTRAP_KEY_PKEX_CR_REQ) { 7429 wpa_printf(MSG_INFO, "DPP: TESTING - no Bootstrap Key"); 7430 goto skip_bootstrap_key; 7431 } 7432 if (dpp_test == DPP_TEST_INVALID_BOOTSTRAP_KEY_PKEX_CR_REQ) { 7433 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Bootstrap Key"); 7434 wpabuf_put_le16(clear, DPP_ATTR_BOOTSTRAP_KEY); 7435 wpabuf_put_le16(clear, 2 * curve->prime_len); 7436 if (dpp_test_gen_invalid_key(clear, curve) < 0) 7437 goto fail; 7438 goto skip_bootstrap_key; 7439 } 7440 #endif /* CONFIG_TESTING_OPTIONS */ 7441 7442 /* A in Bootstrap Key attribute */ 7443 wpabuf_put_le16(clear, DPP_ATTR_BOOTSTRAP_KEY); 7444 wpabuf_put_le16(clear, wpabuf_len(A_pub)); 7445 wpabuf_put_buf(clear, A_pub); 7446 7447 #ifdef CONFIG_TESTING_OPTIONS 7448 skip_bootstrap_key: 7449 if (dpp_test == DPP_TEST_NO_I_AUTH_TAG_PKEX_CR_REQ) { 7450 wpa_printf(MSG_INFO, "DPP: TESTING - no I-Auth tag"); 7451 goto skip_i_auth_tag; 7452 } 7453 if (dpp_test == DPP_TEST_I_AUTH_TAG_MISMATCH_PKEX_CR_REQ) { 7454 wpa_printf(MSG_INFO, "DPP: TESTING - I-Auth tag mismatch"); 7455 wpabuf_put_le16(clear, DPP_ATTR_I_AUTH_TAG); 7456 wpabuf_put_le16(clear, curve->hash_len); 7457 wpabuf_put_data(clear, u, curve->hash_len - 1); 7458 wpabuf_put_u8(clear, u[curve->hash_len - 1] ^ 0x01); 7459 goto skip_i_auth_tag; 7460 } 7461 #endif /* CONFIG_TESTING_OPTIONS */ 7462 7463 /* u in I-Auth tag attribute */ 7464 wpabuf_put_le16(clear, DPP_ATTR_I_AUTH_TAG); 7465 wpabuf_put_le16(clear, curve->hash_len); 7466 wpabuf_put_data(clear, u, curve->hash_len); 7467 7468 #ifdef CONFIG_TESTING_OPTIONS 7469 skip_i_auth_tag: 7470 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_PKEX_CR_REQ) { 7471 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 7472 goto skip_wrapped_data; 7473 } 7474 #endif /* CONFIG_TESTING_OPTIONS */ 7475 7476 addr[0] = wpabuf_head_u8(msg) + 2; 7477 len[0] = DPP_HDR_LEN; 7478 octet = 0; 7479 addr[1] = &octet; 7480 len[1] = sizeof(octet); 7481 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 7482 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 7483 7484 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 7485 wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 7486 wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 7487 7488 wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); 7489 if (aes_siv_encrypt(pkex->z, curve->hash_len, 7490 wpabuf_head(clear), wpabuf_len(clear), 7491 2, addr, len, wrapped) < 0) 7492 goto fail; 7493 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 7494 wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); 7495 7496 #ifdef CONFIG_TESTING_OPTIONS 7497 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_REQ) { 7498 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 7499 dpp_build_attr_status(msg, DPP_STATUS_OK); 7500 } 7501 skip_wrapped_data: 7502 #endif /* CONFIG_TESTING_OPTIONS */ 7503 7504 out: 7505 wpabuf_free(clear); 7506 return msg; 7507 7508 fail: 7509 wpabuf_free(msg); 7510 msg = NULL; 7511 goto out; 7512 } 7513 7514 7515 struct wpabuf * dpp_pkex_rx_exchange_resp(struct dpp_pkex *pkex, 7516 const u8 *peer_mac, 7517 const u8 *buf, size_t buflen) 7518 { 7519 const u8 *attr_status, *attr_id, *attr_key, *attr_group; 7520 u16 attr_status_len, attr_id_len, attr_key_len, attr_group_len; 7521 const EC_GROUP *group; 7522 BN_CTX *bnctx = NULL; 7523 struct wpabuf *msg = NULL, *A_pub = NULL, *X_pub = NULL, *Y_pub = NULL; 7524 const struct dpp_curve_params *curve = pkex->own_bi->curve; 7525 EC_POINT *Qr = NULL, *Y = NULL, *N = NULL; 7526 BIGNUM *Nx = NULL, *Ny = NULL; 7527 EVP_PKEY_CTX *ctx = NULL; 7528 EC_KEY *Y_ec = NULL; 7529 size_t Jx_len, Kx_len; 7530 u8 Jx[DPP_MAX_SHARED_SECRET_LEN], Kx[DPP_MAX_SHARED_SECRET_LEN]; 7531 const u8 *addr[4]; 7532 size_t len[4]; 7533 u8 u[DPP_MAX_HASH_LEN]; 7534 int res; 7535 7536 if (pkex->failed || pkex->t >= PKEX_COUNTER_T_LIMIT || !pkex->initiator) 7537 return NULL; 7538 7539 #ifdef CONFIG_TESTING_OPTIONS 7540 if (dpp_test == DPP_TEST_STOP_AT_PKEX_EXCHANGE_RESP) { 7541 wpa_printf(MSG_INFO, 7542 "DPP: TESTING - stop at PKEX Exchange Response"); 7543 pkex->failed = 1; 7544 return NULL; 7545 } 7546 7547 if (!is_zero_ether_addr(dpp_pkex_peer_mac_override)) { 7548 wpa_printf(MSG_INFO, "DPP: TESTING - peer_mac override " MACSTR, 7549 MAC2STR(dpp_pkex_peer_mac_override)); 7550 peer_mac = dpp_pkex_peer_mac_override; 7551 } 7552 #endif /* CONFIG_TESTING_OPTIONS */ 7553 7554 os_memcpy(pkex->peer_mac, peer_mac, ETH_ALEN); 7555 7556 attr_status = dpp_get_attr(buf, buflen, DPP_ATTR_STATUS, 7557 &attr_status_len); 7558 if (!attr_status || attr_status_len != 1) { 7559 dpp_pkex_fail(pkex, "No DPP Status attribute"); 7560 return NULL; 7561 } 7562 wpa_printf(MSG_DEBUG, "DPP: Status %u", attr_status[0]); 7563 7564 if (attr_status[0] == DPP_STATUS_BAD_GROUP) { 7565 attr_group = dpp_get_attr(buf, buflen, 7566 DPP_ATTR_FINITE_CYCLIC_GROUP, 7567 &attr_group_len); 7568 if (attr_group && attr_group_len == 2) { 7569 wpa_msg(pkex->msg_ctx, MSG_INFO, DPP_EVENT_FAIL 7570 "Peer indicated mismatching PKEX group - proposed %u", 7571 WPA_GET_LE16(attr_group)); 7572 return NULL; 7573 } 7574 } 7575 7576 if (attr_status[0] != DPP_STATUS_OK) { 7577 dpp_pkex_fail(pkex, "PKEX failed (peer indicated failure)"); 7578 return NULL; 7579 } 7580 7581 attr_id_len = 0; 7582 attr_id = dpp_get_attr(buf, buflen, DPP_ATTR_CODE_IDENTIFIER, 7583 &attr_id_len); 7584 if (!dpp_pkex_identifier_match(attr_id, attr_id_len, 7585 pkex->identifier)) { 7586 dpp_pkex_fail(pkex, "PKEX code identifier mismatch"); 7587 return NULL; 7588 } 7589 7590 /* N in Encrypted Key attribute */ 7591 attr_key = dpp_get_attr(buf, buflen, DPP_ATTR_ENCRYPTED_KEY, 7592 &attr_key_len); 7593 if (!attr_key || attr_key_len & 0x01 || attr_key_len < 2) { 7594 dpp_pkex_fail(pkex, "Missing Encrypted Key attribute"); 7595 return NULL; 7596 } 7597 7598 /* Qr = H(MAC-Responder | [identifier |] code) * Pr */ 7599 bnctx = BN_CTX_new(); 7600 if (!bnctx) 7601 goto fail; 7602 Qr = dpp_pkex_derive_Qr(curve, pkex->peer_mac, pkex->code, 7603 pkex->identifier, bnctx, &group); 7604 if (!Qr) 7605 goto fail; 7606 7607 /* Y' = N - Qr */ 7608 Y = EC_POINT_new(group); 7609 N = EC_POINT_new(group); 7610 Nx = BN_bin2bn(attr_key, attr_key_len / 2, NULL); 7611 Ny = BN_bin2bn(attr_key + attr_key_len / 2, attr_key_len / 2, NULL); 7612 if (!Y || !N || !Nx || !Ny || 7613 EC_POINT_set_affine_coordinates_GFp(group, N, Nx, Ny, bnctx) != 1 || 7614 EC_POINT_is_at_infinity(group, N) || 7615 !EC_POINT_is_on_curve(group, N, bnctx) || 7616 EC_POINT_invert(group, Qr, bnctx) != 1 || 7617 EC_POINT_add(group, Y, N, Qr, bnctx) != 1 || 7618 EC_POINT_is_at_infinity(group, Y) || 7619 !EC_POINT_is_on_curve(group, Y, bnctx)) { 7620 dpp_pkex_fail(pkex, "Invalid Encrypted Key value"); 7621 pkex->t++; 7622 goto fail; 7623 } 7624 dpp_debug_print_point("DPP: N", group, N); 7625 dpp_debug_print_point("DPP: Y'", group, Y); 7626 7627 pkex->exchange_done = 1; 7628 7629 /* ECDH: J = a * Y */ 7630 Y_ec = EC_KEY_new(); 7631 if (!Y_ec || 7632 EC_KEY_set_group(Y_ec, group) != 1 || 7633 EC_KEY_set_public_key(Y_ec, Y) != 1) 7634 goto fail; 7635 pkex->y = EVP_PKEY_new(); 7636 if (!pkex->y || 7637 EVP_PKEY_set1_EC_KEY(pkex->y, Y_ec) != 1) 7638 goto fail; 7639 ctx = EVP_PKEY_CTX_new(pkex->own_bi->pubkey, NULL); 7640 if (!ctx || 7641 EVP_PKEY_derive_init(ctx) != 1 || 7642 EVP_PKEY_derive_set_peer(ctx, pkex->y) != 1 || 7643 EVP_PKEY_derive(ctx, NULL, &Jx_len) != 1 || 7644 Jx_len > DPP_MAX_SHARED_SECRET_LEN || 7645 EVP_PKEY_derive(ctx, Jx, &Jx_len) != 1) { 7646 wpa_printf(MSG_ERROR, 7647 "DPP: Failed to derive ECDH shared secret: %s", 7648 ERR_error_string(ERR_get_error(), NULL)); 7649 goto fail; 7650 } 7651 7652 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (J.x)", 7653 Jx, Jx_len); 7654 7655 /* u = HMAC(J.x, MAC-Initiator | A.x | Y.x | X.x ) */ 7656 A_pub = dpp_get_pubkey_point(pkex->own_bi->pubkey, 0); 7657 Y_pub = dpp_get_pubkey_point(pkex->y, 0); 7658 X_pub = dpp_get_pubkey_point(pkex->x, 0); 7659 if (!A_pub || !Y_pub || !X_pub) 7660 goto fail; 7661 addr[0] = pkex->own_mac; 7662 len[0] = ETH_ALEN; 7663 addr[1] = wpabuf_head(A_pub); 7664 len[1] = wpabuf_len(A_pub) / 2; 7665 addr[2] = wpabuf_head(Y_pub); 7666 len[2] = wpabuf_len(Y_pub) / 2; 7667 addr[3] = wpabuf_head(X_pub); 7668 len[3] = wpabuf_len(X_pub) / 2; 7669 if (dpp_hmac_vector(curve->hash_len, Jx, Jx_len, 4, addr, len, u) < 0) 7670 goto fail; 7671 wpa_hexdump(MSG_DEBUG, "DPP: u", u, curve->hash_len); 7672 7673 /* K = x * Y */ 7674 EVP_PKEY_CTX_free(ctx); 7675 ctx = EVP_PKEY_CTX_new(pkex->x, NULL); 7676 if (!ctx || 7677 EVP_PKEY_derive_init(ctx) != 1 || 7678 EVP_PKEY_derive_set_peer(ctx, pkex->y) != 1 || 7679 EVP_PKEY_derive(ctx, NULL, &Kx_len) != 1 || 7680 Kx_len > DPP_MAX_SHARED_SECRET_LEN || 7681 EVP_PKEY_derive(ctx, Kx, &Kx_len) != 1) { 7682 wpa_printf(MSG_ERROR, 7683 "DPP: Failed to derive ECDH shared secret: %s", 7684 ERR_error_string(ERR_get_error(), NULL)); 7685 goto fail; 7686 } 7687 7688 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (K.x)", 7689 Kx, Kx_len); 7690 7691 /* z = HKDF(<>, MAC-Initiator | MAC-Responder | M.x | N.x | code, K.x) 7692 */ 7693 res = dpp_pkex_derive_z(pkex->own_mac, pkex->peer_mac, 7694 pkex->Mx, curve->prime_len, 7695 attr_key /* N.x */, attr_key_len / 2, 7696 pkex->code, Kx, Kx_len, 7697 pkex->z, curve->hash_len); 7698 os_memset(Kx, 0, Kx_len); 7699 if (res < 0) 7700 goto fail; 7701 7702 msg = dpp_pkex_build_commit_reveal_req(pkex, A_pub, u); 7703 if (!msg) 7704 goto fail; 7705 7706 out: 7707 wpabuf_free(A_pub); 7708 wpabuf_free(X_pub); 7709 wpabuf_free(Y_pub); 7710 EC_POINT_free(Qr); 7711 EC_POINT_free(Y); 7712 EC_POINT_free(N); 7713 BN_free(Nx); 7714 BN_free(Ny); 7715 EC_KEY_free(Y_ec); 7716 EVP_PKEY_CTX_free(ctx); 7717 BN_CTX_free(bnctx); 7718 return msg; 7719 fail: 7720 wpa_printf(MSG_DEBUG, "DPP: PKEX Exchange Response processing failed"); 7721 goto out; 7722 } 7723 7724 7725 static struct wpabuf * 7726 dpp_pkex_build_commit_reveal_resp(struct dpp_pkex *pkex, 7727 const struct wpabuf *B_pub, const u8 *v) 7728 { 7729 const struct dpp_curve_params *curve = pkex->own_bi->curve; 7730 struct wpabuf *msg = NULL; 7731 const u8 *addr[2]; 7732 size_t len[2]; 7733 u8 octet; 7734 u8 *wrapped; 7735 struct wpabuf *clear = NULL; 7736 size_t clear_len, attr_len; 7737 7738 /* {B, v [bootstrapping info]}z */ 7739 clear_len = 4 + 2 * curve->prime_len + 4 + curve->hash_len; 7740 clear = wpabuf_alloc(clear_len); 7741 attr_len = 4 + clear_len + AES_BLOCK_SIZE; 7742 #ifdef CONFIG_TESTING_OPTIONS 7743 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_RESP) 7744 attr_len += 5; 7745 #endif /* CONFIG_TESTING_OPTIONS */ 7746 msg = dpp_alloc_msg(DPP_PA_PKEX_COMMIT_REVEAL_RESP, attr_len); 7747 if (!clear || !msg) 7748 goto fail; 7749 7750 #ifdef CONFIG_TESTING_OPTIONS 7751 if (dpp_test == DPP_TEST_NO_BOOTSTRAP_KEY_PKEX_CR_RESP) { 7752 wpa_printf(MSG_INFO, "DPP: TESTING - no Bootstrap Key"); 7753 goto skip_bootstrap_key; 7754 } 7755 if (dpp_test == DPP_TEST_INVALID_BOOTSTRAP_KEY_PKEX_CR_RESP) { 7756 wpa_printf(MSG_INFO, "DPP: TESTING - invalid Bootstrap Key"); 7757 wpabuf_put_le16(clear, DPP_ATTR_BOOTSTRAP_KEY); 7758 wpabuf_put_le16(clear, 2 * curve->prime_len); 7759 if (dpp_test_gen_invalid_key(clear, curve) < 0) 7760 goto fail; 7761 goto skip_bootstrap_key; 7762 } 7763 #endif /* CONFIG_TESTING_OPTIONS */ 7764 7765 /* B in Bootstrap Key attribute */ 7766 wpabuf_put_le16(clear, DPP_ATTR_BOOTSTRAP_KEY); 7767 wpabuf_put_le16(clear, wpabuf_len(B_pub)); 7768 wpabuf_put_buf(clear, B_pub); 7769 7770 #ifdef CONFIG_TESTING_OPTIONS 7771 skip_bootstrap_key: 7772 if (dpp_test == DPP_TEST_NO_R_AUTH_TAG_PKEX_CR_RESP) { 7773 wpa_printf(MSG_INFO, "DPP: TESTING - no R-Auth tag"); 7774 goto skip_r_auth_tag; 7775 } 7776 if (dpp_test == DPP_TEST_R_AUTH_TAG_MISMATCH_PKEX_CR_RESP) { 7777 wpa_printf(MSG_INFO, "DPP: TESTING - R-Auth tag mismatch"); 7778 wpabuf_put_le16(clear, DPP_ATTR_R_AUTH_TAG); 7779 wpabuf_put_le16(clear, curve->hash_len); 7780 wpabuf_put_data(clear, v, curve->hash_len - 1); 7781 wpabuf_put_u8(clear, v[curve->hash_len - 1] ^ 0x01); 7782 goto skip_r_auth_tag; 7783 } 7784 #endif /* CONFIG_TESTING_OPTIONS */ 7785 7786 /* v in R-Auth tag attribute */ 7787 wpabuf_put_le16(clear, DPP_ATTR_R_AUTH_TAG); 7788 wpabuf_put_le16(clear, curve->hash_len); 7789 wpabuf_put_data(clear, v, curve->hash_len); 7790 7791 #ifdef CONFIG_TESTING_OPTIONS 7792 skip_r_auth_tag: 7793 if (dpp_test == DPP_TEST_NO_WRAPPED_DATA_PKEX_CR_RESP) { 7794 wpa_printf(MSG_INFO, "DPP: TESTING - no Wrapped Data"); 7795 goto skip_wrapped_data; 7796 } 7797 #endif /* CONFIG_TESTING_OPTIONS */ 7798 7799 addr[0] = wpabuf_head_u8(msg) + 2; 7800 len[0] = DPP_HDR_LEN; 7801 octet = 1; 7802 addr[1] = &octet; 7803 len[1] = sizeof(octet); 7804 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 7805 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 7806 7807 wpabuf_put_le16(msg, DPP_ATTR_WRAPPED_DATA); 7808 wpabuf_put_le16(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 7809 wrapped = wpabuf_put(msg, wpabuf_len(clear) + AES_BLOCK_SIZE); 7810 7811 wpa_hexdump_buf(MSG_DEBUG, "DPP: AES-SIV cleartext", clear); 7812 if (aes_siv_encrypt(pkex->z, curve->hash_len, 7813 wpabuf_head(clear), wpabuf_len(clear), 7814 2, addr, len, wrapped) < 0) 7815 goto fail; 7816 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 7817 wrapped, wpabuf_len(clear) + AES_BLOCK_SIZE); 7818 7819 #ifdef CONFIG_TESTING_OPTIONS 7820 if (dpp_test == DPP_TEST_AFTER_WRAPPED_DATA_PKEX_CR_RESP) { 7821 wpa_printf(MSG_INFO, "DPP: TESTING - attr after Wrapped Data"); 7822 dpp_build_attr_status(msg, DPP_STATUS_OK); 7823 } 7824 skip_wrapped_data: 7825 #endif /* CONFIG_TESTING_OPTIONS */ 7826 7827 out: 7828 wpabuf_free(clear); 7829 return msg; 7830 7831 fail: 7832 wpabuf_free(msg); 7833 msg = NULL; 7834 goto out; 7835 } 7836 7837 7838 struct wpabuf * dpp_pkex_rx_commit_reveal_req(struct dpp_pkex *pkex, 7839 const u8 *hdr, 7840 const u8 *buf, size_t buflen) 7841 { 7842 const struct dpp_curve_params *curve = pkex->own_bi->curve; 7843 EVP_PKEY_CTX *ctx = NULL; 7844 size_t Jx_len, Lx_len; 7845 u8 Jx[DPP_MAX_SHARED_SECRET_LEN]; 7846 u8 Lx[DPP_MAX_SHARED_SECRET_LEN]; 7847 const u8 *wrapped_data, *b_key, *peer_u; 7848 u16 wrapped_data_len, b_key_len, peer_u_len = 0; 7849 const u8 *addr[4]; 7850 size_t len[4]; 7851 u8 octet; 7852 u8 *unwrapped = NULL; 7853 size_t unwrapped_len = 0; 7854 struct wpabuf *msg = NULL, *A_pub = NULL, *X_pub = NULL, *Y_pub = NULL; 7855 struct wpabuf *B_pub = NULL; 7856 u8 u[DPP_MAX_HASH_LEN], v[DPP_MAX_HASH_LEN]; 7857 7858 #ifdef CONFIG_TESTING_OPTIONS 7859 if (dpp_test == DPP_TEST_STOP_AT_PKEX_CR_REQ) { 7860 wpa_printf(MSG_INFO, 7861 "DPP: TESTING - stop at PKEX CR Request"); 7862 pkex->failed = 1; 7863 return NULL; 7864 } 7865 #endif /* CONFIG_TESTING_OPTIONS */ 7866 7867 if (!pkex->exchange_done || pkex->failed || 7868 pkex->t >= PKEX_COUNTER_T_LIMIT || pkex->initiator) 7869 goto fail; 7870 7871 wrapped_data = dpp_get_attr(buf, buflen, DPP_ATTR_WRAPPED_DATA, 7872 &wrapped_data_len); 7873 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 7874 dpp_pkex_fail(pkex, 7875 "Missing or invalid required Wrapped Data attribute"); 7876 goto fail; 7877 } 7878 7879 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 7880 wrapped_data, wrapped_data_len); 7881 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 7882 unwrapped = os_malloc(unwrapped_len); 7883 if (!unwrapped) 7884 goto fail; 7885 7886 addr[0] = hdr; 7887 len[0] = DPP_HDR_LEN; 7888 octet = 0; 7889 addr[1] = &octet; 7890 len[1] = sizeof(octet); 7891 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 7892 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 7893 7894 if (aes_siv_decrypt(pkex->z, curve->hash_len, 7895 wrapped_data, wrapped_data_len, 7896 2, addr, len, unwrapped) < 0) { 7897 dpp_pkex_fail(pkex, 7898 "AES-SIV decryption failed - possible PKEX code mismatch"); 7899 pkex->failed = 1; 7900 pkex->t++; 7901 goto fail; 7902 } 7903 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 7904 unwrapped, unwrapped_len); 7905 7906 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 7907 dpp_pkex_fail(pkex, "Invalid attribute in unwrapped data"); 7908 goto fail; 7909 } 7910 7911 b_key = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_BOOTSTRAP_KEY, 7912 &b_key_len); 7913 if (!b_key || b_key_len != 2 * curve->prime_len) { 7914 dpp_pkex_fail(pkex, "No valid peer bootstrapping key found"); 7915 goto fail; 7916 } 7917 pkex->peer_bootstrap_key = dpp_set_pubkey_point(pkex->x, b_key, 7918 b_key_len); 7919 if (!pkex->peer_bootstrap_key) { 7920 dpp_pkex_fail(pkex, "Peer bootstrapping key is invalid"); 7921 goto fail; 7922 } 7923 dpp_debug_print_key("DPP: Peer bootstrap public key", 7924 pkex->peer_bootstrap_key); 7925 7926 /* ECDH: J' = y * A' */ 7927 ctx = EVP_PKEY_CTX_new(pkex->y, NULL); 7928 if (!ctx || 7929 EVP_PKEY_derive_init(ctx) != 1 || 7930 EVP_PKEY_derive_set_peer(ctx, pkex->peer_bootstrap_key) != 1 || 7931 EVP_PKEY_derive(ctx, NULL, &Jx_len) != 1 || 7932 Jx_len > DPP_MAX_SHARED_SECRET_LEN || 7933 EVP_PKEY_derive(ctx, Jx, &Jx_len) != 1) { 7934 wpa_printf(MSG_ERROR, 7935 "DPP: Failed to derive ECDH shared secret: %s", 7936 ERR_error_string(ERR_get_error(), NULL)); 7937 goto fail; 7938 } 7939 7940 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (J.x)", 7941 Jx, Jx_len); 7942 7943 /* u' = HMAC(J'.x, MAC-Initiator | A'.x | Y.x | X'.x) */ 7944 A_pub = dpp_get_pubkey_point(pkex->peer_bootstrap_key, 0); 7945 Y_pub = dpp_get_pubkey_point(pkex->y, 0); 7946 X_pub = dpp_get_pubkey_point(pkex->x, 0); 7947 if (!A_pub || !Y_pub || !X_pub) 7948 goto fail; 7949 addr[0] = pkex->peer_mac; 7950 len[0] = ETH_ALEN; 7951 addr[1] = wpabuf_head(A_pub); 7952 len[1] = wpabuf_len(A_pub) / 2; 7953 addr[2] = wpabuf_head(Y_pub); 7954 len[2] = wpabuf_len(Y_pub) / 2; 7955 addr[3] = wpabuf_head(X_pub); 7956 len[3] = wpabuf_len(X_pub) / 2; 7957 if (dpp_hmac_vector(curve->hash_len, Jx, Jx_len, 4, addr, len, u) < 0) 7958 goto fail; 7959 7960 peer_u = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_I_AUTH_TAG, 7961 &peer_u_len); 7962 if (!peer_u || peer_u_len != curve->hash_len || 7963 os_memcmp(peer_u, u, curve->hash_len) != 0) { 7964 dpp_pkex_fail(pkex, "No valid u (I-Auth tag) found"); 7965 wpa_hexdump(MSG_DEBUG, "DPP: Calculated u'", 7966 u, curve->hash_len); 7967 wpa_hexdump(MSG_DEBUG, "DPP: Received u", peer_u, peer_u_len); 7968 pkex->t++; 7969 goto fail; 7970 } 7971 wpa_printf(MSG_DEBUG, "DPP: Valid u (I-Auth tag) received"); 7972 7973 /* ECDH: L = b * X' */ 7974 EVP_PKEY_CTX_free(ctx); 7975 ctx = EVP_PKEY_CTX_new(pkex->own_bi->pubkey, NULL); 7976 if (!ctx || 7977 EVP_PKEY_derive_init(ctx) != 1 || 7978 EVP_PKEY_derive_set_peer(ctx, pkex->x) != 1 || 7979 EVP_PKEY_derive(ctx, NULL, &Lx_len) != 1 || 7980 Lx_len > DPP_MAX_SHARED_SECRET_LEN || 7981 EVP_PKEY_derive(ctx, Lx, &Lx_len) != 1) { 7982 wpa_printf(MSG_ERROR, 7983 "DPP: Failed to derive ECDH shared secret: %s", 7984 ERR_error_string(ERR_get_error(), NULL)); 7985 goto fail; 7986 } 7987 7988 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (L.x)", 7989 Lx, Lx_len); 7990 7991 /* v = HMAC(L.x, MAC-Responder | B.x | X'.x | Y.x) */ 7992 B_pub = dpp_get_pubkey_point(pkex->own_bi->pubkey, 0); 7993 if (!B_pub) 7994 goto fail; 7995 addr[0] = pkex->own_mac; 7996 len[0] = ETH_ALEN; 7997 addr[1] = wpabuf_head(B_pub); 7998 len[1] = wpabuf_len(B_pub) / 2; 7999 addr[2] = wpabuf_head(X_pub); 8000 len[2] = wpabuf_len(X_pub) / 2; 8001 addr[3] = wpabuf_head(Y_pub); 8002 len[3] = wpabuf_len(Y_pub) / 2; 8003 if (dpp_hmac_vector(curve->hash_len, Lx, Lx_len, 4, addr, len, v) < 0) 8004 goto fail; 8005 wpa_hexdump(MSG_DEBUG, "DPP: v", v, curve->hash_len); 8006 8007 msg = dpp_pkex_build_commit_reveal_resp(pkex, B_pub, v); 8008 if (!msg) 8009 goto fail; 8010 8011 out: 8012 EVP_PKEY_CTX_free(ctx); 8013 os_free(unwrapped); 8014 wpabuf_free(A_pub); 8015 wpabuf_free(B_pub); 8016 wpabuf_free(X_pub); 8017 wpabuf_free(Y_pub); 8018 return msg; 8019 fail: 8020 wpa_printf(MSG_DEBUG, 8021 "DPP: PKEX Commit-Reveal Request processing failed"); 8022 goto out; 8023 } 8024 8025 8026 int dpp_pkex_rx_commit_reveal_resp(struct dpp_pkex *pkex, const u8 *hdr, 8027 const u8 *buf, size_t buflen) 8028 { 8029 const struct dpp_curve_params *curve = pkex->own_bi->curve; 8030 const u8 *wrapped_data, *b_key, *peer_v; 8031 u16 wrapped_data_len, b_key_len, peer_v_len = 0; 8032 const u8 *addr[4]; 8033 size_t len[4]; 8034 u8 octet; 8035 u8 *unwrapped = NULL; 8036 size_t unwrapped_len = 0; 8037 int ret = -1; 8038 u8 v[DPP_MAX_HASH_LEN]; 8039 size_t Lx_len; 8040 u8 Lx[DPP_MAX_SHARED_SECRET_LEN]; 8041 EVP_PKEY_CTX *ctx = NULL; 8042 struct wpabuf *B_pub = NULL, *X_pub = NULL, *Y_pub = NULL; 8043 8044 #ifdef CONFIG_TESTING_OPTIONS 8045 if (dpp_test == DPP_TEST_STOP_AT_PKEX_CR_RESP) { 8046 wpa_printf(MSG_INFO, 8047 "DPP: TESTING - stop at PKEX CR Response"); 8048 pkex->failed = 1; 8049 goto fail; 8050 } 8051 #endif /* CONFIG_TESTING_OPTIONS */ 8052 8053 if (!pkex->exchange_done || pkex->failed || 8054 pkex->t >= PKEX_COUNTER_T_LIMIT || !pkex->initiator) 8055 goto fail; 8056 8057 wrapped_data = dpp_get_attr(buf, buflen, DPP_ATTR_WRAPPED_DATA, 8058 &wrapped_data_len); 8059 if (!wrapped_data || wrapped_data_len < AES_BLOCK_SIZE) { 8060 dpp_pkex_fail(pkex, 8061 "Missing or invalid required Wrapped Data attribute"); 8062 goto fail; 8063 } 8064 8065 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV ciphertext", 8066 wrapped_data, wrapped_data_len); 8067 unwrapped_len = wrapped_data_len - AES_BLOCK_SIZE; 8068 unwrapped = os_malloc(unwrapped_len); 8069 if (!unwrapped) 8070 goto fail; 8071 8072 addr[0] = hdr; 8073 len[0] = DPP_HDR_LEN; 8074 octet = 1; 8075 addr[1] = &octet; 8076 len[1] = sizeof(octet); 8077 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[0]", addr[0], len[0]); 8078 wpa_hexdump(MSG_DEBUG, "DDP: AES-SIV AD[1]", addr[1], len[1]); 8079 8080 if (aes_siv_decrypt(pkex->z, curve->hash_len, 8081 wrapped_data, wrapped_data_len, 8082 2, addr, len, unwrapped) < 0) { 8083 dpp_pkex_fail(pkex, 8084 "AES-SIV decryption failed - possible PKEX code mismatch"); 8085 pkex->t++; 8086 goto fail; 8087 } 8088 wpa_hexdump(MSG_DEBUG, "DPP: AES-SIV cleartext", 8089 unwrapped, unwrapped_len); 8090 8091 if (dpp_check_attrs(unwrapped, unwrapped_len) < 0) { 8092 dpp_pkex_fail(pkex, "Invalid attribute in unwrapped data"); 8093 goto fail; 8094 } 8095 8096 b_key = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_BOOTSTRAP_KEY, 8097 &b_key_len); 8098 if (!b_key || b_key_len != 2 * curve->prime_len) { 8099 dpp_pkex_fail(pkex, "No valid peer bootstrapping key found"); 8100 goto fail; 8101 } 8102 pkex->peer_bootstrap_key = dpp_set_pubkey_point(pkex->x, b_key, 8103 b_key_len); 8104 if (!pkex->peer_bootstrap_key) { 8105 dpp_pkex_fail(pkex, "Peer bootstrapping key is invalid"); 8106 goto fail; 8107 } 8108 dpp_debug_print_key("DPP: Peer bootstrap public key", 8109 pkex->peer_bootstrap_key); 8110 8111 /* ECDH: L' = x * B' */ 8112 ctx = EVP_PKEY_CTX_new(pkex->x, NULL); 8113 if (!ctx || 8114 EVP_PKEY_derive_init(ctx) != 1 || 8115 EVP_PKEY_derive_set_peer(ctx, pkex->peer_bootstrap_key) != 1 || 8116 EVP_PKEY_derive(ctx, NULL, &Lx_len) != 1 || 8117 Lx_len > DPP_MAX_SHARED_SECRET_LEN || 8118 EVP_PKEY_derive(ctx, Lx, &Lx_len) != 1) { 8119 wpa_printf(MSG_ERROR, 8120 "DPP: Failed to derive ECDH shared secret: %s", 8121 ERR_error_string(ERR_get_error(), NULL)); 8122 goto fail; 8123 } 8124 8125 wpa_hexdump_key(MSG_DEBUG, "DPP: ECDH shared secret (L.x)", 8126 Lx, Lx_len); 8127 8128 /* v' = HMAC(L.x, MAC-Responder | B'.x | X.x | Y'.x) */ 8129 B_pub = dpp_get_pubkey_point(pkex->peer_bootstrap_key, 0); 8130 X_pub = dpp_get_pubkey_point(pkex->x, 0); 8131 Y_pub = dpp_get_pubkey_point(pkex->y, 0); 8132 if (!B_pub || !X_pub || !Y_pub) 8133 goto fail; 8134 addr[0] = pkex->peer_mac; 8135 len[0] = ETH_ALEN; 8136 addr[1] = wpabuf_head(B_pub); 8137 len[1] = wpabuf_len(B_pub) / 2; 8138 addr[2] = wpabuf_head(X_pub); 8139 len[2] = wpabuf_len(X_pub) / 2; 8140 addr[3] = wpabuf_head(Y_pub); 8141 len[3] = wpabuf_len(Y_pub) / 2; 8142 if (dpp_hmac_vector(curve->hash_len, Lx, Lx_len, 4, addr, len, v) < 0) 8143 goto fail; 8144 8145 peer_v = dpp_get_attr(unwrapped, unwrapped_len, DPP_ATTR_R_AUTH_TAG, 8146 &peer_v_len); 8147 if (!peer_v || peer_v_len != curve->hash_len || 8148 os_memcmp(peer_v, v, curve->hash_len) != 0) { 8149 dpp_pkex_fail(pkex, "No valid v (R-Auth tag) found"); 8150 wpa_hexdump(MSG_DEBUG, "DPP: Calculated v'", 8151 v, curve->hash_len); 8152 wpa_hexdump(MSG_DEBUG, "DPP: Received v", peer_v, peer_v_len); 8153 pkex->t++; 8154 goto fail; 8155 } 8156 wpa_printf(MSG_DEBUG, "DPP: Valid v (R-Auth tag) received"); 8157 8158 ret = 0; 8159 out: 8160 wpabuf_free(B_pub); 8161 wpabuf_free(X_pub); 8162 wpabuf_free(Y_pub); 8163 EVP_PKEY_CTX_free(ctx); 8164 os_free(unwrapped); 8165 return ret; 8166 fail: 8167 goto out; 8168 } 8169 8170 8171 void dpp_pkex_free(struct dpp_pkex *pkex) 8172 { 8173 if (!pkex) 8174 return; 8175 8176 os_free(pkex->identifier); 8177 os_free(pkex->code); 8178 EVP_PKEY_free(pkex->x); 8179 EVP_PKEY_free(pkex->y); 8180 EVP_PKEY_free(pkex->peer_bootstrap_key); 8181 wpabuf_free(pkex->exchange_req); 8182 wpabuf_free(pkex->exchange_resp); 8183 os_free(pkex); 8184 } 8185 8186 8187 #ifdef CONFIG_TESTING_OPTIONS 8188 char * dpp_corrupt_connector_signature(const char *connector) 8189 { 8190 char *tmp, *pos, *signed3 = NULL; 8191 unsigned char *signature = NULL; 8192 size_t signature_len = 0, signed3_len; 8193 8194 tmp = os_zalloc(os_strlen(connector) + 5); 8195 if (!tmp) 8196 goto fail; 8197 os_memcpy(tmp, connector, os_strlen(connector)); 8198 8199 pos = os_strchr(tmp, '.'); 8200 if (!pos) 8201 goto fail; 8202 8203 pos = os_strchr(pos + 1, '.'); 8204 if (!pos) 8205 goto fail; 8206 pos++; 8207 8208 wpa_printf(MSG_DEBUG, "DPP: Original base64url encoded signature: %s", 8209 pos); 8210 signature = base64_url_decode((const unsigned char *) pos, 8211 os_strlen(pos), &signature_len); 8212 if (!signature || signature_len == 0) 8213 goto fail; 8214 wpa_hexdump(MSG_DEBUG, "DPP: Original Connector signature", 8215 signature, signature_len); 8216 signature[signature_len - 1] ^= 0x01; 8217 wpa_hexdump(MSG_DEBUG, "DPP: Corrupted Connector signature", 8218 signature, signature_len); 8219 signed3 = (char *) base64_url_encode(signature, signature_len, 8220 &signed3_len, 0); 8221 if (!signed3) 8222 goto fail; 8223 os_memcpy(pos, signed3, signed3_len); 8224 pos[signed3_len] = '\0'; 8225 wpa_printf(MSG_DEBUG, "DPP: Corrupted base64url encoded signature: %s", 8226 pos); 8227 8228 out: 8229 os_free(signature); 8230 os_free(signed3); 8231 return tmp; 8232 fail: 8233 os_free(tmp); 8234 tmp = NULL; 8235 goto out; 8236 } 8237 #endif /* CONFIG_TESTING_OPTIONS */ 8238 8239 8240 #ifdef CONFIG_DPP2 8241 8242 struct dpp_pfs * dpp_pfs_init(const u8 *net_access_key, 8243 size_t net_access_key_len) 8244 { 8245 struct wpabuf *pub = NULL; 8246 EVP_PKEY *own_key; 8247 struct dpp_pfs *pfs; 8248 8249 pfs = os_zalloc(sizeof(*pfs)); 8250 if (!pfs) 8251 return NULL; 8252 8253 own_key = dpp_set_keypair(&pfs->curve, net_access_key, 8254 net_access_key_len); 8255 if (!own_key) { 8256 wpa_printf(MSG_ERROR, "DPP: Failed to parse own netAccessKey"); 8257 goto fail; 8258 } 8259 EVP_PKEY_free(own_key); 8260 8261 pfs->ecdh = crypto_ecdh_init(pfs->curve->ike_group); 8262 if (!pfs->ecdh) 8263 goto fail; 8264 8265 pub = crypto_ecdh_get_pubkey(pfs->ecdh, 0); 8266 pub = wpabuf_zeropad(pub, pfs->curve->prime_len); 8267 if (!pub) 8268 goto fail; 8269 8270 pfs->ie = wpabuf_alloc(5 + wpabuf_len(pub)); 8271 if (!pfs->ie) 8272 goto fail; 8273 wpabuf_put_u8(pfs->ie, WLAN_EID_EXTENSION); 8274 wpabuf_put_u8(pfs->ie, 1 + 2 + wpabuf_len(pub)); 8275 wpabuf_put_u8(pfs->ie, WLAN_EID_EXT_OWE_DH_PARAM); 8276 wpabuf_put_le16(pfs->ie, pfs->curve->ike_group); 8277 wpabuf_put_buf(pfs->ie, pub); 8278 wpabuf_free(pub); 8279 wpa_hexdump_buf(MSG_DEBUG, "DPP: Diffie-Hellman Parameter element", 8280 pfs->ie); 8281 8282 return pfs; 8283 fail: 8284 wpabuf_free(pub); 8285 dpp_pfs_free(pfs); 8286 return NULL; 8287 } 8288 8289 8290 int dpp_pfs_process(struct dpp_pfs *pfs, const u8 *peer_ie, size_t peer_ie_len) 8291 { 8292 if (peer_ie_len < 2) 8293 return -1; 8294 if (WPA_GET_LE16(peer_ie) != pfs->curve->ike_group) { 8295 wpa_printf(MSG_DEBUG, "DPP: Peer used different group for PFS"); 8296 return -1; 8297 } 8298 8299 pfs->secret = crypto_ecdh_set_peerkey(pfs->ecdh, 0, peer_ie + 2, 8300 peer_ie_len - 2); 8301 pfs->secret = wpabuf_zeropad(pfs->secret, pfs->curve->prime_len); 8302 if (!pfs->secret) { 8303 wpa_printf(MSG_DEBUG, "DPP: Invalid peer DH public key"); 8304 return -1; 8305 } 8306 wpa_hexdump_buf_key(MSG_DEBUG, "DPP: DH shared secret", pfs->secret); 8307 return 0; 8308 } 8309 8310 8311 void dpp_pfs_free(struct dpp_pfs *pfs) 8312 { 8313 if (!pfs) 8314 return; 8315 crypto_ecdh_deinit(pfs->ecdh); 8316 wpabuf_free(pfs->ie); 8317 wpabuf_clear_free(pfs->secret); 8318 os_free(pfs); 8319 } 8320 8321 #endif /* CONFIG_DPP2 */ 8322 8323 8324 static unsigned int dpp_next_id(struct dpp_global *dpp) 8325 { 8326 struct dpp_bootstrap_info *bi; 8327 unsigned int max_id = 0; 8328 8329 dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) { 8330 if (bi->id > max_id) 8331 max_id = bi->id; 8332 } 8333 return max_id + 1; 8334 } 8335 8336 8337 static int dpp_bootstrap_del(struct dpp_global *dpp, unsigned int id) 8338 { 8339 struct dpp_bootstrap_info *bi, *tmp; 8340 int found = 0; 8341 8342 if (!dpp) 8343 return -1; 8344 8345 dl_list_for_each_safe(bi, tmp, &dpp->bootstrap, 8346 struct dpp_bootstrap_info, list) { 8347 if (id && bi->id != id) 8348 continue; 8349 found = 1; 8350 dl_list_del(&bi->list); 8351 dpp_bootstrap_info_free(bi); 8352 } 8353 8354 if (id == 0) 8355 return 0; /* flush succeeds regardless of entries found */ 8356 return found ? 0 : -1; 8357 } 8358 8359 8360 struct dpp_bootstrap_info * dpp_add_qr_code(struct dpp_global *dpp, 8361 const char *uri) 8362 { 8363 struct dpp_bootstrap_info *bi; 8364 8365 if (!dpp) 8366 return NULL; 8367 8368 bi = dpp_parse_qr_code(uri); 8369 if (!bi) 8370 return NULL; 8371 8372 bi->id = dpp_next_id(dpp); 8373 dl_list_add(&dpp->bootstrap, &bi->list); 8374 return bi; 8375 } 8376 8377 8378 int dpp_bootstrap_gen(struct dpp_global *dpp, const char *cmd) 8379 { 8380 char *chan = NULL, *mac = NULL, *info = NULL, *pk = NULL, *curve = NULL; 8381 char *key = NULL; 8382 u8 *privkey = NULL; 8383 size_t privkey_len = 0; 8384 size_t len; 8385 int ret = -1; 8386 struct dpp_bootstrap_info *bi; 8387 8388 if (!dpp) 8389 return -1; 8390 8391 bi = os_zalloc(sizeof(*bi)); 8392 if (!bi) 8393 goto fail; 8394 8395 if (os_strstr(cmd, "type=qrcode")) 8396 bi->type = DPP_BOOTSTRAP_QR_CODE; 8397 else if (os_strstr(cmd, "type=pkex")) 8398 bi->type = DPP_BOOTSTRAP_PKEX; 8399 else 8400 goto fail; 8401 8402 chan = get_param(cmd, " chan="); 8403 mac = get_param(cmd, " mac="); 8404 info = get_param(cmd, " info="); 8405 curve = get_param(cmd, " curve="); 8406 key = get_param(cmd, " key="); 8407 8408 if (key) { 8409 privkey_len = os_strlen(key) / 2; 8410 privkey = os_malloc(privkey_len); 8411 if (!privkey || 8412 hexstr2bin(key, privkey, privkey_len) < 0) 8413 goto fail; 8414 } 8415 8416 pk = dpp_keygen(bi, curve, privkey, privkey_len); 8417 if (!pk) 8418 goto fail; 8419 8420 len = 4; /* "DPP:" */ 8421 if (chan) { 8422 if (dpp_parse_uri_chan_list(bi, chan) < 0) 8423 goto fail; 8424 len += 3 + os_strlen(chan); /* C:...; */ 8425 } 8426 if (mac) { 8427 if (dpp_parse_uri_mac(bi, mac) < 0) 8428 goto fail; 8429 len += 3 + os_strlen(mac); /* M:...; */ 8430 } 8431 if (info) { 8432 if (dpp_parse_uri_info(bi, info) < 0) 8433 goto fail; 8434 len += 3 + os_strlen(info); /* I:...; */ 8435 } 8436 len += 4 + os_strlen(pk); 8437 bi->uri = os_malloc(len + 1); 8438 if (!bi->uri) 8439 goto fail; 8440 os_snprintf(bi->uri, len + 1, "DPP:%s%s%s%s%s%s%s%s%sK:%s;;", 8441 chan ? "C:" : "", chan ? chan : "", chan ? ";" : "", 8442 mac ? "M:" : "", mac ? mac : "", mac ? ";" : "", 8443 info ? "I:" : "", info ? info : "", info ? ";" : "", 8444 pk); 8445 bi->id = dpp_next_id(dpp); 8446 dl_list_add(&dpp->bootstrap, &bi->list); 8447 ret = bi->id; 8448 bi = NULL; 8449 fail: 8450 os_free(curve); 8451 os_free(pk); 8452 os_free(chan); 8453 os_free(mac); 8454 os_free(info); 8455 str_clear_free(key); 8456 bin_clear_free(privkey, privkey_len); 8457 dpp_bootstrap_info_free(bi); 8458 return ret; 8459 } 8460 8461 8462 struct dpp_bootstrap_info * 8463 dpp_bootstrap_get_id(struct dpp_global *dpp, unsigned int id) 8464 { 8465 struct dpp_bootstrap_info *bi; 8466 8467 if (!dpp) 8468 return NULL; 8469 8470 dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) { 8471 if (bi->id == id) 8472 return bi; 8473 } 8474 return NULL; 8475 } 8476 8477 8478 int dpp_bootstrap_remove(struct dpp_global *dpp, const char *id) 8479 { 8480 unsigned int id_val; 8481 8482 if (os_strcmp(id, "*") == 0) { 8483 id_val = 0; 8484 } else { 8485 id_val = atoi(id); 8486 if (id_val == 0) 8487 return -1; 8488 } 8489 8490 return dpp_bootstrap_del(dpp, id_val); 8491 } 8492 8493 8494 struct dpp_bootstrap_info * 8495 dpp_pkex_finish(struct dpp_global *dpp, struct dpp_pkex *pkex, const u8 *peer, 8496 unsigned int freq) 8497 { 8498 struct dpp_bootstrap_info *bi; 8499 8500 bi = os_zalloc(sizeof(*bi)); 8501 if (!bi) 8502 return NULL; 8503 bi->id = dpp_next_id(dpp); 8504 bi->type = DPP_BOOTSTRAP_PKEX; 8505 os_memcpy(bi->mac_addr, peer, ETH_ALEN); 8506 bi->num_freq = 1; 8507 bi->freq[0] = freq; 8508 bi->curve = pkex->own_bi->curve; 8509 bi->pubkey = pkex->peer_bootstrap_key; 8510 pkex->peer_bootstrap_key = NULL; 8511 if (dpp_bootstrap_key_hash(bi) < 0) { 8512 dpp_bootstrap_info_free(bi); 8513 return NULL; 8514 } 8515 dpp_pkex_free(pkex); 8516 dl_list_add(&dpp->bootstrap, &bi->list); 8517 return bi; 8518 } 8519 8520 8521 const char * dpp_bootstrap_get_uri(struct dpp_global *dpp, unsigned int id) 8522 { 8523 struct dpp_bootstrap_info *bi; 8524 8525 bi = dpp_bootstrap_get_id(dpp, id); 8526 if (!bi) 8527 return NULL; 8528 return bi->uri; 8529 } 8530 8531 8532 int dpp_bootstrap_info(struct dpp_global *dpp, int id, 8533 char *reply, int reply_size) 8534 { 8535 struct dpp_bootstrap_info *bi; 8536 8537 bi = dpp_bootstrap_get_id(dpp, id); 8538 if (!bi) 8539 return -1; 8540 return os_snprintf(reply, reply_size, "type=%s\n" 8541 "mac_addr=" MACSTR "\n" 8542 "info=%s\n" 8543 "num_freq=%u\n" 8544 "curve=%s\n", 8545 dpp_bootstrap_type_txt(bi->type), 8546 MAC2STR(bi->mac_addr), 8547 bi->info ? bi->info : "", 8548 bi->num_freq, 8549 bi->curve->name); 8550 } 8551 8552 8553 void dpp_bootstrap_find_pair(struct dpp_global *dpp, const u8 *i_bootstrap, 8554 const u8 *r_bootstrap, 8555 struct dpp_bootstrap_info **own_bi, 8556 struct dpp_bootstrap_info **peer_bi) 8557 { 8558 struct dpp_bootstrap_info *bi; 8559 8560 *own_bi = NULL; 8561 *peer_bi = NULL; 8562 if (!dpp) 8563 return; 8564 8565 dl_list_for_each(bi, &dpp->bootstrap, struct dpp_bootstrap_info, list) { 8566 if (!*own_bi && bi->own && 8567 os_memcmp(bi->pubkey_hash, r_bootstrap, 8568 SHA256_MAC_LEN) == 0) { 8569 wpa_printf(MSG_DEBUG, 8570 "DPP: Found matching own bootstrapping information"); 8571 *own_bi = bi; 8572 } 8573 8574 if (!*peer_bi && !bi->own && 8575 os_memcmp(bi->pubkey_hash, i_bootstrap, 8576 SHA256_MAC_LEN) == 0) { 8577 wpa_printf(MSG_DEBUG, 8578 "DPP: Found matching peer bootstrapping information"); 8579 *peer_bi = bi; 8580 } 8581 8582 if (*own_bi && *peer_bi) 8583 break; 8584 } 8585 8586 } 8587 8588 8589 static unsigned int dpp_next_configurator_id(struct dpp_global *dpp) 8590 { 8591 struct dpp_configurator *conf; 8592 unsigned int max_id = 0; 8593 8594 dl_list_for_each(conf, &dpp->configurator, struct dpp_configurator, 8595 list) { 8596 if (conf->id > max_id) 8597 max_id = conf->id; 8598 } 8599 return max_id + 1; 8600 } 8601 8602 8603 int dpp_configurator_add(struct dpp_global *dpp, const char *cmd) 8604 { 8605 char *curve = NULL; 8606 char *key = NULL; 8607 u8 *privkey = NULL; 8608 size_t privkey_len = 0; 8609 int ret = -1; 8610 struct dpp_configurator *conf = NULL; 8611 8612 curve = get_param(cmd, " curve="); 8613 key = get_param(cmd, " key="); 8614 8615 if (key) { 8616 privkey_len = os_strlen(key) / 2; 8617 privkey = os_malloc(privkey_len); 8618 if (!privkey || 8619 hexstr2bin(key, privkey, privkey_len) < 0) 8620 goto fail; 8621 } 8622 8623 conf = dpp_keygen_configurator(curve, privkey, privkey_len); 8624 if (!conf) 8625 goto fail; 8626 8627 conf->id = dpp_next_configurator_id(dpp); 8628 dl_list_add(&dpp->configurator, &conf->list); 8629 ret = conf->id; 8630 conf = NULL; 8631 fail: 8632 os_free(curve); 8633 str_clear_free(key); 8634 bin_clear_free(privkey, privkey_len); 8635 dpp_configurator_free(conf); 8636 return ret; 8637 } 8638 8639 8640 static int dpp_configurator_del(struct dpp_global *dpp, unsigned int id) 8641 { 8642 struct dpp_configurator *conf, *tmp; 8643 int found = 0; 8644 8645 if (!dpp) 8646 return -1; 8647 8648 dl_list_for_each_safe(conf, tmp, &dpp->configurator, 8649 struct dpp_configurator, list) { 8650 if (id && conf->id != id) 8651 continue; 8652 found = 1; 8653 dl_list_del(&conf->list); 8654 dpp_configurator_free(conf); 8655 } 8656 8657 if (id == 0) 8658 return 0; /* flush succeeds regardless of entries found */ 8659 return found ? 0 : -1; 8660 } 8661 8662 8663 int dpp_configurator_remove(struct dpp_global *dpp, const char *id) 8664 { 8665 unsigned int id_val; 8666 8667 if (os_strcmp(id, "*") == 0) { 8668 id_val = 0; 8669 } else { 8670 id_val = atoi(id); 8671 if (id_val == 0) 8672 return -1; 8673 } 8674 8675 return dpp_configurator_del(dpp, id_val); 8676 } 8677 8678 8679 int dpp_configurator_get_key_id(struct dpp_global *dpp, unsigned int id, 8680 char *buf, size_t buflen) 8681 { 8682 struct dpp_configurator *conf; 8683 8684 conf = dpp_configurator_get_id(dpp, id); 8685 if (!conf) 8686 return -1; 8687 8688 return dpp_configurator_get_key(conf, buf, buflen); 8689 } 8690 8691 8692 struct dpp_global * dpp_global_init(void) 8693 { 8694 struct dpp_global *dpp; 8695 8696 dpp = os_zalloc(sizeof(*dpp)); 8697 if (!dpp) 8698 return NULL; 8699 8700 dl_list_init(&dpp->bootstrap); 8701 dl_list_init(&dpp->configurator); 8702 8703 return dpp; 8704 } 8705 8706 8707 void dpp_global_clear(struct dpp_global *dpp) 8708 { 8709 if (!dpp) 8710 return; 8711 8712 dpp_bootstrap_del(dpp, 0); 8713 dpp_configurator_del(dpp, 0); 8714 } 8715 8716 8717 void dpp_global_deinit(struct dpp_global *dpp) 8718 { 8719 dpp_global_clear(dpp); 8720 os_free(dpp); 8721 } 8722
